https://community.splunk.com/t5/Splunk-Search/Search-Time-Range/m-p/303983#M91437 <P>It is possible that you don't see a difference because you may not have any data that would be different. The relative time modifiers is discussed in the documents here: <A href="https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/SearchTimeModifiers#How_to_specify_relative_time_modifiers">https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/SearchTimeModifiers#How_to_specify_relative_time_modifiers</A></P> <P>But for your specific question... Let's say you're running a search and it is right now to the sub-second exactly: 12:51:39.135</P> <P>earliest=-15m would mean the earliest time for your time range is exactly 15 minutes ago, or 12:36:39.135</P> <P>earliest=-15m@s means take the current time, subtract 15 minutes, and then round down to the nearest second, or in other words: 12:36:39.000</P> <P>Unless you're dealing with high volumes of data that comes from devices that log down to subsecond precision it's unlikely that you would see differences between these two examples. But relative time modifiers locking down in general is a pretty handy thing to be familiar with.</P> Wed, 15 Feb 2017 03:56:31 GMT acharlieh 2017-02-15T03:56:31Z https://community.splunk.com/t5/Splunk-Search/Search-Time-Range/m-p/303982#M91436 <P>Hi,</P> <P>I have a simple question, what is the difference between <EM>earliest=-15m</EM> with <EM>earliest=-15m@s</EM>?</P> <P>I could not find any diff when run my search. Any help is appreciated. Thanks</P> Wed, 15 Feb 2017 03:45:58 GMT https://community.splunk.com/t5/Splunk-Search/Search-Time-Range/m-p/303982#M91436 dellytaniasetia 2017-02-15T03:45:58Z https://community.splunk.com/t5/Splunk-Search/Search-Time-Range/m-p/303983#M91437 <P>It is possible that you don't see a difference because you may not have any data that would be different. The relative time modifiers is discussed in the documents here: <A href="https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/SearchTimeModifiers#How_to_specify_relative_time_modifiers">https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/SearchTimeModifiers#How_to_specify_relative_time_modifiers</A></P> <P>But for your specific question... Let's say you're running a search and it is right now to the sub-second exactly: 12:51:39.135</P> <P>earliest=-15m would mean the earliest time for your time range is exactly 15 minutes ago, or 12:36:39.135</P> <P>earliest=-15m@s means take the current time, subtract 15 minutes, and then round down to the nearest second, or in other words: 12:36:39.000</P> <P>Unless you're dealing with high volumes of data that comes from devices that log down to subsecond precision it's unlikely that you would see differences between these two examples. But relative time modifiers locking down in general is a pretty handy thing to be familiar with.</P> Wed, 15 Feb 2017 03:56:31 GMT https://community.splunk.com/t5/Splunk-Search/Search-Time-Range/m-p/303983#M91437 acharlieh 2017-02-15T03:56:31Z