https://community.splunk.com/t5/Splunk-Search/Is-the-time-range-for-search-inclusive-or-exclusive/m-p/218757#M64305 <P>Hi,</P> <P>When I search using the Python API and provide <CODE>earliest_time</CODE> and <CODE>latest_time</CODE>, I guess it is an inclusive range, but can anyone confirm with documentation?</P> <P>Thanks!</P> Mon, 08 Aug 2016 20:17:00 GMT rajiv_abraham 2016-08-08T20:17:00Z https://community.splunk.com/t5/Splunk-Search/Is-the-time-range-for-search-inclusive-or-exclusive/m-p/218757#M64305 <P>Hi,</P> <P>When I search using the Python API and provide <CODE>earliest_time</CODE> and <CODE>latest_time</CODE>, I guess it is an inclusive range, but can anyone confirm with documentation?</P> <P>Thanks!</P> Mon, 08 Aug 2016 20:17:00 GMT https://community.splunk.com/t5/Splunk-Search/Is-the-time-range-for-search-inclusive-or-exclusive/m-p/218757#M64305 rajiv_abraham 2016-08-08T20:17:00Z https://community.splunk.com/t5/Splunk-Search/Is-the-time-range-for-search-inclusive-or-exclusive/m-p/218758#M64306 <P>Earliest is inclusive, latest is exclusive. In math terms, <CODE>[earliest, latest)</CODE>.<BR /> It has to be one of each, else events would be missed or doubled if you schedule a search over an hour time range every hour.<BR /> Logically, <CODE>-d@d</CODE> to <CODE>@d</CODE> then gives you "everything with a date of yesterday and any time" - sounds very sane to me.</P> <P>The docs aren't very explicit on that, the bottom example backs this up here though: <A href="http://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Specifytimemodifiersinyoursearch#Examples_of_searches_with_relative_time_modifiers">http://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Specifytimemodifiersinyoursearch#Examples_of_searches_with_relative_time_modifiers</A></P> Mon, 08 Aug 2016 20:41:58 GMT https://community.splunk.com/t5/Splunk-Search/Is-the-time-range-for-search-inclusive-or-exclusive/m-p/218758#M64306 martin_mueller 2016-08-08T20:41:58Z