topic What does <time_unit> default to? in Splunk Search

What does default to?

pm771 — Wed, 08 Feb 2023 15:20:38 GMT

Because of a typo we had the following in our query:

earliest=-1@d

Since Splunk query actually ran I assumed that some kind of default value had been used.

I could not find such details in docs.

Re: What does default to?

ITWhisperer — Wed, 08 Feb 2023 16:00:45 GMT

Time is stored in seconds so -1 is previous second (from now), @d will align to the beginning of the day, so-1@d is midnight last night unless you run the search within the first second of today, in which case it will be midnight on the previous night.

Re: What does default to?

shivanshu1593 — Wed, 08 Feb 2023 16:24:15 GMT

Hello,

You are correct in identifying its behavior. When you write earliest=-1@d, it gives you the results on the basis of @d, which is every single result from the beginning of the day. -1 as ITWhisperer correctly pointed out accounts for a second and has no visible impact.

Re: What does default to?

ITWhisperer — Wed, 08 Feb 2023 16:20:42 GMT

As I said, -1 is not ignored, it is just that it has no appreciable impact, unless going back 1 second takes you back to the previous day. Essentially, without a time unit, seconds is assumed / defaulted.

Re: What does default to?

shivanshu1593 — Wed, 08 Feb 2023 16:26:09 GMT

Hello,

Thank you for correcting me and letting us know the correct behavior. I didn't know the correct fact here. I've updated the answer as well. 🙂

Re: What does default to?

pm771 — Wed, 08 Feb 2023 22:50:24 GMT

I tried

index= earliest=-600@m | stats max(_time) as maxT min(_time) as minT | eval maxtime=strftime(maxT,"%Y-%m-%dT%H:%M:%S.%Q"), mintime=strftime(minT,"%Y-%m-%dT%H:%M:%S.%Q")

and got back 10 min of events as expected based on your explanation.