topic Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time? in Splunk Search

Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?

jacobtom — Thu, 11 Sep 2014 00:46:31 GMT

Hi,

I used to set specific date and time range while doing a search in splunk however it started setting 2001 as the date by default as soon as I hit on search button even if I provide another date & time.
Appreciate the fix. Thanks
Jacob

Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?

laithmurad — Thu, 11 Sep 2014 03:18:15 GMT

I'm having the same issue.

Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?

RaudeWoods — Thu, 11 Sep 2014 14:29:30 GMT

Note I am trying to resolve this too..
Tried upgrading to newest version with no luck.
I have noticed this is happening from multiple Browsers when hitting the indexer directly and the search heads.

Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?

devicenul1 — Thu, 11 Sep 2014 15:17:18 GMT

I encountered this Tuesday(9/9/2014) and ended up putting a ticket in ... the rep I called into said that this is a bug they are currently working on. I can tell you I am running 6.1.1 but from the short conversation I had with him it sounded like it was all current versions running on Windows machines. I just sent another message asking for an update but I got the impression that this was a priority and they were going to issue a fix for it ASAP.

Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?

devicenul1 — Thu, 11 Sep 2014 18:11:22 GMT

Got this from support:

What happened is that on Saturday, 09/06/2014 - we passed a magic point where the epoch time returned 1410065408, which is (10^10)%(2^32).? Due to a bit of difference between the way Windows handles unsigned integers (it considers them 32 bit vs 64 bit), the value passed was being truncated.
So all in all, what does this impact Any 32-bit install of Splunk - Windows & Linux 64-bit installs of Splunk - Windows
This includes versions 5.x,6.x, and 6.1.x of Splunk.

Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?

lrudolph — Mon, 15 Sep 2014 05:52:47 GMT

Having the same problem running 6.1.3 on a Windows W2KR8 SP1-Cluster. Is there any workaround to get results from lets say the day before yesterday?

Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?

linu1988 — Mon, 15 Sep 2014 10:11:39 GMT

Someone give a patch. It's kind of wield when it does round up to 2001. What is the config file in Splunk which is causing this? We are using Splunk x64 6.1.3 we have the issue

Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?

las — Mon, 15 Sep 2014 14:09:43 GMT

This looks like the same problem as this one

http://answers.splunk.com/answers/154984/why-time-range-picker-on-default-splunk-6-1-x-ui-shows-earliest-time-cannot-be-greater-than-latest-time-errors.html

Hopefully this will get fixed soon.

Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?

skinnear — Mon, 15 Sep 2014 16:40:09 GMT

Any update on this as we just noticed this bug this morning.

Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?

bsolberg — Mon, 15 Sep 2014 19:05:24 GMT

Same issue here and we are running 6.0.1 (search head) on a Windows 2008 R2 server. Searching from the LINUX indexers is not affected so it makes me wonder if this may have something to do with a Microsoft patch that was recently released.

Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?

ankeetashet — Mon, 15 Sep 2014 19:48:19 GMT

We are having the same issue too from the last few days. Any workaround for the same, please let us know.

Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?

lrudolph — Tue, 16 Sep 2014 05:49:31 GMT

I don't think this has something to do with a Microsoft patch on server side - we don't have automatic updates configured and ran into this problem anyway.

Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?

mikaelbje — Tue, 16 Sep 2014 11:18:40 GMT

+1. I need this fixed

Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?

vhallan_splunk — Wed, 17 Sep 2014 09:46:47 GMT

The work around is mentioned in the Splunk Answers Post above:

Add the "earliest= and latest=" commands to the search query.

Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?

neelamssantosh — Mon, 28 Sep 2020 17:36:38 GMT

have a Look into your ui-pref.conf file.
dispatch.earliest_time =
dispatch.latest_time =
http://docs.splunk.com/Documentation/Splunk/6.1.3/Admin/Ui-prefsconf

Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?

las — Wed, 17 Sep 2014 10:13:13 GMT

That is a workaround, yes - but it is not practical in our situation, where there is a lot of saved reports, with a timepicker, or dashboards with a timepicker. I'm not saying it is not possible to use the workaround, but it's not usable.

Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?

bsolberg — Wed, 17 Sep 2014 16:56:35 GMT

UI-Pref.conf is not the issue as the problem isn't that the default selection is from 2001... but rather that when we select a date (even leaving it as a 2014 date that is shown by default) the search is actually run against another date. To be clear the date is not the same but with a different year. The actual search is against a different date & time in September. The LAST date I can search for and where the date and/or time range selector actually works is September 6th, 2014 21:50:07.999 PT (EPOCH: 1410065407 sec or 1410065407999 ms).

I have a feeling that maybe it is a digit concatenation or hitting the max length of their "_time" field but those are just guesses.

Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?

linu1988 — Thu, 18 Sep 2014 09:32:46 GMT

I agree that is not at all a practical solution for the end users. It should be provided as an early patch 😞

Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?

joebaglio — Fri, 19 Sep 2014 22:33:13 GMT

Dear Splunk. Please fix this ASAP. I am still on eval and likely will not recommend licensing with this bug outstanding. It is inexcusable.

Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?

sowings — Fri, 19 Sep 2014 22:36:37 GMT

The way the OS handles integers is inexcusable on the part of Splunk?