topic Re: What's the relationship between api_lt/api_et and search_lt/search_et in _audit? in Splunk Search

What's the relationship between api_lt/api_et and search_lt/search_et in _audit?

danielbb — Fri, 27 Jun 2025 15:57:25 GMT

Are these fields mutually exclusive? I'm not sure about the relation between these four fields.

Re: What's the relationship between api_lt/api_et and search_lt/search_et in _audit?

livehybrid — Fri, 27 Jun 2025 16:26:42 GMT

My understanding on this (and I'd also be pleased if someone can confirm!) is that api_lt and api_et represent the time parameters provided by the user in the time picker or API when running a search, but search_lt and search_et represent the actual earliest and latest time used by Splunk during the search execution.

If the user specifies an earliest/latest in the search for example, this would override the time picker values (api_et/api_lt). If not earliest/latest in the search then search_et/lt become api_lt.

I dont recall seeing docs around this though so if someone can find any please let me know 🙂

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: What's the relationship between api_lt/api_et and search_lt/search_et in _audit?

tscroggins — Mon, 30 Jun 2025 01:07:12 GMT

Hi @livehybrid,

api_lt and api_et should correspond to the UI time range or the earliest_time and latest_time search API paramters as you noted, although I don't know if this is publicly documented.

Similarly, api_index_et and api_index_lt should correspond to the index_earliest and index_latest search API parameters.

search_lt and search_et should correspond to the computed epoch second values from the earliest, latest, and other time modifiers if they're provided as part of the base search:

index=main foo earliest=-24h@h latest=now

index=main foo starttime=06/29/2025:20:50:00

The audit log doesn't appear to capture the values passed to _index_earliest and _index_latest or translate them to api_index_et and api_index_lt, unfortunately, but they should be present in the search text.

Re: What's the relationship between api_lt/api_et and search_lt/search_et in _audit?

PrewinThomas — Mon, 30 Jun 2025 04:46:42 GMT

@danielbb

I dont think there is any public document available from Splunk for this field-to-field explanations.
They doesn't seem mutually exclusive, as it can be same or differ depends on the search.

Also you can refer - #https://community.splunk.com/t5/Splunk-Search/index-audit-contents/m-p/338588

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!