topic Re: Hardcoded time parameters inside a search doesn't work with v9.4.3 in Splunk Search

Hardcoded time parameters inside a search doesn't work with v9.4.3

Manjunathmuni — Fri, 25 Jul 2025 11:05:46 GMT

Hello Splunkers,

The hardcoded time parameters inside a simple search don't work with v9.4.3. It only takes the input from the time presets. Do you also experience a similar issue?

index=index earliest="-7d@d" latest="-1m@m" and my preset is last 15 mins, then I get this output.

earliestTime latestTime

07/25/2025 10:40:01.636

07/25/2025 10:52:59.564

Very strange. Nothing mentioned on this in the release notes.

Re: Hardcoded time parameters inside a search doesn't work with v9.4.3

ITWhisperer — Fri, 25 Jul 2025 11:11:18 GMT

Very strange indeed - it works fine for me (same version). Are you trying this in a dashboard or just in the search app?

Re: Hardcoded time parameters inside a search doesn't work with v9.4.3

Manjunathmuni — Fri, 25 Jul 2025 11:12:08 GMT

Search & Reporting app

Re: Hardcoded time parameters inside a search doesn't work with v9.4.3

ITWhisperer — Fri, 25 Jul 2025 11:14:59 GMT

Have you tried other indexes? Or other users?

Re: Hardcoded time parameters inside a search doesn't work with v9.4.3

Manjunathmuni — Fri, 25 Jul 2025 13:49:07 GMT

Unfortunately, it's the same with other indexes as well, including _* indexes.
We tried with another user ID, and the issue is still the same.

Re: Hardcoded time parameters inside a search doesn't work with v9.4.3

PickleRick — Fri, 25 Jul 2025 21:51:59 GMT

I would check the job inspector (and job log) for the details of the exact search being spawned. Doesn't your users' role have some limits set for search time ranges? And does it also "work" the same way when you chose longer time range from the time picker?

Re: Hardcoded time parameters inside a search doesn't work with v9.4.3

livehybrid — Sat, 26 Jul 2025 21:25:05 GMT

Hi @Manjunathmuni

Ive tried to replicate this issue but not had any success.

Can I check - do you have any srchFilters, srchTimeEarliest or srchTimeWin set in your authorize.conf for your role? Does this affect users in different roles too?

I would suggest raising this with Splunk supportto get this raised.

In the meantime please confirm the above regarding the role(s).

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Hardcoded time parameters inside a search doesn't work with v9.4.3

bowesmana — Sun, 27 Jul 2025 23:35:42 GMT

@Manjunathmuni How are you producing that output for earliestTime and latestTime.

Please share the query that produces that output, because those two times do not show the 15 minute preset range. Please also open the job inspector from a search you have run with those SPL values and then open the job properties at the bottom of that page and look for earliestTime and latestTime and post those.

They will be of the format 2025-07-28T00:31:00.000+01:00, not the same as your output.

Re: Hardcoded time parameters inside a search doesn't work with v9.4.3

Manjunathmuni — Mon, 28 Jul 2025 16:08:59 GMT

This issue occurs only with certain apps, such as Search and Reporting, ITSI, and a few other applications. but works seamlessly on certain apps. The screenshots here are taken from the Search & Reporting app.

works with _internal index

doesn't work with other indexes.

In order for it to work, I need to extend the preset time beyond the earliest time passed inside the search. I have not seen this behavior earlier.

Re: Hardcoded time parameters inside a search doesn't work with v9.4.3

bowesmana — Thu, 31 Jul 2025 00:43:30 GMT

Are you saying if you run that second search in a different app context, the behaviour is different.

Note that your SPL logic to do stats earliest(_time) as min_time will not tell you the actual search range, just the time of the earliest event it found.

Try the SPL

... | stats min(_time) as min_time max(_time) as max_time by index | convert ctime(min_time) ctime(max_time) | addinfo

The addinfo command will show you the actual search range used by the search irrespective of any events found.