Apply timeformat to earliest/latest attributes

[frank_zhang]

Hi,

We embed splunk in our product and need to generate searches with earliest/latest attributes based on timestamp user picks, and our server and splunk indexer might be running in different timezones. We can either generate a timestamp based on indexer's timezone and put no timezone in it, such as:

sourcetype=foo index=bar earliest=10/18/2012:13:00:00 |...

Or generate timestamp based on other timezone or UTC and put timezone info in it, such as:

sourcetype=foo index=bar timeformat%m/%d/%Y:%H:%M:%S:%z earliest=10/18/2012:17:00:00:+0000 |...

Is there any negative impact such as performance overhead with the second option due to adding "timeformat%m/%d/%Y:%H:%M:%S:%z" into the search?

Thanks in advance.

[frank_zhang]

With our GUI we allow users to specify both absolute and relative time range, we generate values like -24h for the latter case.

[_d_ · Accepted solution]

Splunk will convert earliest and latest timestamps in epoch format internally. Therefore, since you can generate timestamps in UTC, your best bet would be to have earliest and latest in epoch as well.

Ex: index=bar sourcetype=foo earliest=1350538170 latest=1350538870 | more search commands

Hope this helps,

d.

[frank_zhang]

That's the first option we considered, however it makes debugging a bit harder since you have to convert from epoch time in order to figure out that the time range specified here, doesn't it?

[kristian_kolb]

I guess you've ruled out the possibility to use relative time modifiers, e.g. -24h, @d, etc etc?

/k