Getting Data In
Highlighted

what format should timestamp be in for starttime?

Motivator

Regarding starttime from the docs

starttime starttime=<timestamp> Search from the specified date and time to the present (inclusive of the specified time).

What format should `` be in?

I have got this working starttime= 04/27/2015:00:00:00, that is mm/dd/yyyy, but I am seeing strange results, possibly duplicates in data. Can anyone advise?

For my reference this is in relation to this Q

0 Karma
Highlighted

Re: what format should timestamp be in for starttime?

SplunkTrust
SplunkTrust

starttime is deprecated and should be avoided. Use earliest, instead. That said, the timestamp format you used is correct. If you want to try a different format, use timeformat (another deprecated command).

I suggest you post a separate question with your search query and sample data so we can help resolve your "strange results".

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: what format should timestamp be in for starttime?

Motivator

I have done in the past and this was the solution then. Can I control earliest and latest date using fixed dates ? I will post it again, shall i?

0 Karma
Highlighted

Re: what format should timestamp be in for starttime?

Motivator
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.