https://community.splunk.com/t5/Splunk-Search/Why-is-Splunk-not-throwing-an-error-when-the-time-range-I/m-p/212584#M62275 <P>Why should you get an error when you search in a timerange that has no data? You'll simply get zero results. It's not "illegal" or somehow "undefined" what happens in that case.</P> Thu, 05 Nov 2015 07:27:01 GMT jeffland 2015-11-05T07:27:01Z https://community.splunk.com/t5/Splunk-Search/Why-is-Splunk-not-throwing-an-error-when-the-time-range-I/m-p/212580#M62271 <P>I have a basic search like this:</P> <PRE><CODE> index=pqr host=xyz* NOT TYPE="*ABCDE*" | fields X, Y |timechart limit=0 span=10m count, avg(X) by Y </CODE></PRE> <P>And I search it using the date range. Today, I tried choosing a date in the past and another one into the future . I expected to be thrown an error, but the search ran without errors. Why? Today is the 3rd. The date I chose was the 4th.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/783iBB1C718D39A72334/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Wed, 04 Nov 2015 00:01:06 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-Splunk-not-throwing-an-error-when-the-time-range-I/m-p/212580#M62271 m_vivek 2015-11-04T00:01:06Z https://community.splunk.com/t5/Splunk-Search/Why-is-Splunk-not-throwing-an-error-when-the-time-range-I/m-p/212581#M62272 <P>Why would you expect an error? The time range you search on (and more importantly, it's relation to the current time) is arbitrary. Splunk will search on data from time X to time Y, regardless of the current time.</P> <P>You will get an error however when you try to index data that is either too old or too far in the future. Generally, it is perfectly legal to index data with a future timestamp (in standard configuration, this means two days ahead). These settings are configured in <A href="http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf">props.conf</A> with <CODE>MAX_DAYS_AGO</CODE> and <CODE>MAX_DAYS_HENCE</CODE>.</P> Wed, 04 Nov 2015 10:38:49 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-Splunk-not-throwing-an-error-when-the-time-range-I/m-p/212581#M62272 jeffland 2015-11-04T10:38:49Z https://community.splunk.com/t5/Splunk-Search/Why-is-Splunk-not-throwing-an-error-when-the-time-range-I/m-p/212582#M62273 <P>Because data is sometimes mis-timestamped, it is necessary to search for "impossible" things such as events that "have not yet happened". The capability to search into the future is a huge benefit when trying to track down things like wrong TZ being applied to timestamps.</P> Wed, 04 Nov 2015 13:43:58 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-Splunk-not-throwing-an-error-when-the-time-range-I/m-p/212582#M62273 woodcock 2015-11-04T13:43:58Z https://community.splunk.com/t5/Splunk-Search/Why-is-Splunk-not-throwing-an-error-when-the-time-range-I/m-p/212583#M62274 <P>Ok. Thanks. I think I now have a better understanding. I was expecting an error because, there was no data present for the future date, and I thought I would get something like 'out of range chosen or invalid dates chosen.' </P> Wed, 04 Nov 2015 22:59:34 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-Splunk-not-throwing-an-error-when-the-time-range-I/m-p/212583#M62274 m_vivek 2015-11-04T22:59:34Z https://community.splunk.com/t5/Splunk-Search/Why-is-Splunk-not-throwing-an-error-when-the-time-range-I/m-p/212584#M62275 <P>Why should you get an error when you search in a timerange that has no data? You'll simply get zero results. It's not "illegal" or somehow "undefined" what happens in that case.</P> Thu, 05 Nov 2015 07:27:01 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-Splunk-not-throwing-an-error-when-the-time-range-I/m-p/212584#M62275 jeffland 2015-11-05T07:27:01Z