Refine Search, Create Alert, Search Time Range Changed!?

[andrewkenth]

In Splunk 6 I am noticing that I when I refine a search and set a time range to Yesterday then save said search as an alert it saves the time range as Last 1 Day (no snap to) until now, instead of Yesterday. Yesterday could be relative but that would be Last 1 day (Beginning of day) until Today (Beginning of today).

Is this user error? A bug?

Thanks for your feedback!

Andrew

[andrewkenth · Accepted solution]

I ended up not using the range picker (setting it to all time) and instead used the earliest= and latest= in my search query.

[di2esysadmin]

I'm have a similar issue. Have saved a search to be "today". When I go back and edit it, it's set to "last 1 hour". Thus it isn't firing as it should.

Running 6.0.1.

I thank you as well.

Karla