topic Re: splunk query in Splunk Search

Setting 'earliest' in a splunk query

harihara — Thu, 10 Jul 2025 14:10:05 GMT

index =prd-Thailand sourcetype=abc-app-log earliest=-75m@m latest=now

|table a, b,c ,d ,e, f
|where a=1324 b=345
|stats count as volume

Question is how to replace earliest=-1440m@m

Please let me know if any more details required

Re: splunk query

livehybrid — Thu, 10 Jul 2025 12:43:28 GMT

Hi @harihara

If you want to search back the last 24 hours then you can just replace the existing "-75m@m" with "-1440m@m", or "-1d" for the last 24 hours from now, or "-1d@m" which is the same as 1440 but just easier to read.

Are you having any issues when trying to replace the -75m@m with "-1440m@m"?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: splunk query

harihara — Thu, 10 Jul 2025 13:56:06 GMT

It is a dasboard query which is used linked other queries as well

Re: splunk query

ITWhisperer — Thu, 10 Jul 2025 14:02:35 GMT

Please provide further detail of what you have and what you are trying to achieve