topic Re: All Time Search Earliest Workload in Splunk Search

All Time Search Earliest Workload

sle — Thu, 28 Mar 2024 20:13:07 GMT

<search> <query>index="ourIndex" sourcetype=$stype$ABC AND Is_Service_Account="True" OR Is_Service_Account="False" earliest=-48h | eval DC=upper(DC) | eval env1=case(DC like "%Q%","QA", DC like "%DEV%","DEV", true(), "PROD") | search env1=$envPure$ AND $domainPure$ |rename DC AS domainPure | stats count </query> <earliest>0</earliest> <latest></latest> </search>

If earliest=-48h and within the source code there is <earliest>0</earliest>, then if we enable an admission rule that disables All Time searches what would happen?

Re: All Time Search Earliest Workload

gcusello — Fri, 29 Mar 2024 06:54:13 GMT

Hi @sle ,

if you use earliest and/or latest fields in your main search, this value override the values that you have in the Time Picker, that's not relevant.

Ciao.

Giuseppe

Re: All Time Search Earliest Workload

gcusello — Tue, 02 Apr 2024 07:21:09 GMT

Hi @sle,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉