Error with earliest and latest keywords

[krish1733]

I'm getting an error when I input earliest and latest keywords with the search query. I have set the time picker corresponding to the values used in the query.  It's showing 'Unknown search command 'earliest'' when trying to use those commands. I'm using splunk Enterprise version.

This is my query:

index=sample ServiceName="cet.prd.*" |  earliest=-3d latest=now()

[ITWhisperer]

earliest and latest are search terms, not commands, remove the pipe '|' which separates command in the search.

[inventsekar]

my apologies,  i read the 3 lines and missed the remaining..

Please try this... 

index=sample ServiceName="cet.prd.*"  earliest=-3d latest=now()

let us know what happens, thanks.  

[krish1733]

@inventsekar Please see my post. I had already added the query there.

[inventsekar]

Hi @krish1733 
Pls check the Splunk Documentation for this topic:

https://docs.splunk.com/Documentation/Splunk/9.1.1/Search/Specifytimemodifiersinyoursearch

Splunk provides many options to specify these times.. for example, you can relatively calculate these times..  you can use a subsearch for calculating these times and pass it to main search. let us know more info about your requirements, so we can suggest you best ideas/solutions. 

As you are a new member, i would like to suggest you.. the karma points / upvotes are appreciated. if any post solves your question, please "accept that as the solution".. so the question will move out of unanswered queue, also it will help those who help you, thanks. 

[inventsekar]

Hi @krish1733 .. pls update us your current Splunk Search query, how the earliest and latest you are calculating.. etc