topic Re: SPL Time range is giving issue in Splunk Search

SPL Time range is giving issue

chimpui — Sat, 03 Aug 2024 09:42:46 GMT

Hi Splunkers!

I wish to get data in a specific time range using earliest and latest command .

I have checked with time picker events are there within the specified range.

But when I am trying to run a spl query its not working :

I have tried with ISO format and custom format as shown below .

When I use ISO format its giving error

index=main sourcetype="access_combined_wcookie" earliest="2024-01-15T20:00:00" latest="2024-02-22T20:00:00"

And when I use custom format as shown below its returning 0 events:

index=main sourcetype="access_combined_wcookie" earliest="1/15/2024:20:00:00" latest="2/22/2024:20:00:00"

Please help I want to do this using earliest and latest command only

Re: SPL Time range is giving issue

ITWhisperer — Sat, 03 Aug 2024 10:14:45 GMT

Your custom format (mm/dd/yyyy:HH:MM:SS) should work assuming you have events in the specified time range

Re: SPL Time range is giving issue

PickleRick — Sat, 03 Aug 2024 10:15:37 GMT

https://docs.splunk.com/Documentation/Splunk/latest/Search/Specifytimemodifiersinyoursearch

But you can also (and it saves you issues with time zones) specify it as epoch timestamp.

Re: SPL Time range is giving issue

yuanliu — Sun, 04 Aug 2024 04:22:34 GMT

And when I use custom format as shown below its returning 0 events:
index=main sourcetype="access_combined_wcookie" earliest="1/15/2024:20:00:00" latest="2/22/2024:20:00:00"

If you read the document @PickleRick posted, you know that this is the only accepted format. To diagnose why you get zero return, you have to prove that you had events in that period. In other words, what makes you think 0 is not the correct result? Is it possible that your events were not ingested with the correct _time value? Forget half years ago. Does searches like

index=main sourcetype="access_combined_wcookie" earliest=-1d

return the correct results? How about the first month of the year?

index=main sourcetype="access_combined_wcookie" earliest=-0y@y latest=-0y@y+1mon

All this is to say, without proper context (raw data, event frequency, etc.), your question is unanswerable.

Re: SPL Time range is giving issue

isoutamo — Wed, 07 Aug 2024 14:58:50 GMT

You probably have already read previous doc? Here is another one https://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutsearchtimeranges.

To be sure that you have correct time span in use, you should use UTC (unix time) as @PickleRick already propose. Remember to convert your local time to UTC before you do that query.

But please remember that Splunk store all event's in UTC time and shows those based on your current TZ definition (defined in User Preferences in your Splunk GUI).