Getting Data In

what format should timestamp be in for starttime?

HattrickNZ
Motivator

Regarding starttime from the docs

starttime starttime=<timestamp> Search from the specified date and time to the present (inclusive of the specified time).

What format should `` be in?

I have got this working starttime= 04/27/2015:00:00:00, that is mm/dd/yyyy, but I am seeing strange results, possibly duplicates in data. Can anyone advise?

For my reference this is in relation to this Q

0 Karma

richgalloway
SplunkTrust
SplunkTrust

starttime is deprecated and should be avoided. Use earliest, instead. That said, the timestamp format you used is correct. If you want to try a different format, use timeformat (another deprecated command).

I suggest you post a separate question with your search query and sample data so we can help resolve your "strange results".

---
If this reply helps you, Karma would be appreciated.
0 Karma

HattrickNZ
Motivator

I have done in the past and this was the solution then. Can I control earliest and latest date using fixed dates ? I will post it again, shall i?

0 Karma

HattrickNZ
Motivator
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...