topic Splunk search earliest and latest in Splunk search in Splunk Search

Splunk search earliest and latest in Splunk search

jaibalaraman — Wed, 08 May 2024 01:29:15 GMT

Splunk search

" EventCode="4688" AND earliest="5/8/2024:10:07:20" latest="5/8/2024:10:17:20 "

Could you please the time search is correct

Re: Splunk search earliest and latest in Splunk search

jaibalaraman — Wed, 08 May 2024 01:29:52 GMT

Also the search can be done in UTC or any time zone'

Re: Splunk search earliest and latest in Splunk search

thahir — Wed, 08 May 2024 02:27:53 GMT

@jaibalaraman search can be in any time zone. can you elaborate your question what you need exactly

Re: Splunk search earliest and latest in Splunk search

jaibalaraman — Wed, 08 May 2024 02:36:57 GMT

I am trying to use earliest and latest on Date time

Could you please advise the right format to use , i am not sure the below spl format is correct

Event Code="1234" AND earliest="5/8/2024:10:07:20" latest="5/8/2024:10:17:20

Re: Splunk search earliest and latest in Splunk search

apietsch — Wed, 08 May 2024 07:01:58 GMT

According to the documentation for search time modifiers you should be correct. Although example 4 and 5 on that page uses a different time format. Try the format from the examples.

Re: Splunk search earliest and latest in Splunk search

thahir — Fri, 10 May 2024 14:01:15 GMT

hi @jaibalaraman ,

You can specify an exact time such as earliest="10/5/2021:20:00:00", or a relative time such as earliest=-h or latest=@w6.

When specifying relative time, you can use the now modifier to refer to the current time.

Re: Splunk search earliest and latest in Splunk search

thahir — Fri, 10 May 2024 14:10:43 GMT

@jaibalaraman , your searches return a consistent set of results regardless of the time zone you are in.