What's the difference in dispatch.earliest_time in Splunk savedsearch.conf?

[Fish_Salted]

I am new to splunk, and trying to understand what’s the difference between dispatch.earliest_time = "-15m@m" and dispatch.earliest_time = "-15m”. Thanks!

[P_vandereerden]

Better late than never answering this, right?

The part after the @ is a snap-to specifier that causes the search to start at the nearest value in that time unit. For example, if the time is 3:16:20, "-15m@m" will search from 3:01:00, where "-15m" will search from 3:01:20

[isoutamo]

Hi

it’s just like @P_vandereerden said. You should read more about it from https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/SearchTimeModifiers#Specify_a_sna...

r. Ismo