Doing a search on CLI with time range modifiers does not seem to work.
I have tried earliest_time/latest_time and index_earliest/index_latest.
I have tired formatting mm/dd/yyy and yyyy-mm-dd.
Format of command is: /opt/splunk/bin/splunk search 'search details' earliest_time=yyyy-mm-dd latest_time=yyyy-mm-dd.
The search works as expected w/out the time range modifiers - and of course works via web. When I try this earliest_time=2018-05-01 latest_time=2018-06-01 max_out=0 I get results from 09/13??
I am running this on the search head in a distributed environment.
you need to convert time using strftime and then compare with earliest and latest instead of earliest_time and latest_time
eval time = strftime(
As far as I know, "earliest/latest" are not supported in CLI searches - according to the documentation? And why do I have to convert?
Thanx
The conversion needs to be done as the time values is considered in seconds format. You can use
eval start_time = strftime("2018-05-01", "%Y-%m-%d") | eval end_time=strftime("2018-06-01", "%Y-%m-%d")|
where ( _time > start_time and _time < end_time)