https://community.splunk.com/t5/Training-Certification/SplunkFundamentals-Module-5/m-p/493107#M1155 <P>Hello, </P> <P>I've been following the free course for Splunk Fundamentals 1 and now I'm on lab 5. I have completed everything successfully up to this point. It is on basic searching and asks me to search "fail* AND password" over All-time. This is where my issue comes into play. </P> <P>When I search over all-time I get 0 results. If I search last week 9,493. If I search last month 49.946.</P> <P>I have verified that I have the correct number of indexed events. My hosts are correct. Why do I get 0 results under all-time? I have also tested under both admin and power accounts and get the same results. </P> Fri, 04 Oct 2019 15:38:31 GMT tylertyler 2019-10-04T15:38:31Z https://community.splunk.com/t5/Training-Certification/SplunkFundamentals-Module-5/m-p/493107#M1155 <P>Hello, </P> <P>I've been following the free course for Splunk Fundamentals 1 and now I'm on lab 5. I have completed everything successfully up to this point. It is on basic searching and asks me to search "fail* AND password" over All-time. This is where my issue comes into play. </P> <P>When I search over all-time I get 0 results. If I search last week 9,493. If I search last month 49.946.</P> <P>I have verified that I have the correct number of indexed events. My hosts are correct. Why do I get 0 results under all-time? I have also tested under both admin and power accounts and get the same results. </P> Fri, 04 Oct 2019 15:38:31 GMT https://community.splunk.com/t5/Training-Certification/SplunkFundamentals-Module-5/m-p/493107#M1155 tylertyler 2019-10-04T15:38:31Z https://community.splunk.com/t5/Training-Certification/SplunkFundamentals-Module-5/m-p/493108#M1156 <P>There are two options, One is All Time and Two is All Time(real-time). The first option is the one you want for labs and is in the presets menu but is cut off, so it displays "Al..." no wonder it was missed. </P> Fri, 04 Oct 2019 17:36:16 GMT https://community.splunk.com/t5/Training-Certification/SplunkFundamentals-Module-5/m-p/493108#M1156 tylertyler 2019-10-04T17:36:16Z