ES 8.0 Upgrade: "Yesterday" time modifier returning early-morning "Today" results compared to ES 7

[KevHaze]

We are currently in the process of upgrading from ES 7.x to ES 8.x and are performing a data validation/parity checks between mission control and incedent review .

We've seen a discrepancy in how the "Yesterday" time picker criteria is being handled.

The Issue: When selecting the "Yesterday" preset in the time range picker:

ES 7: Returns the expected results (only events from the previous calendar day).

ES 8: Returns results from yesterday, but is also "leaking" results from early this morning (specifically events at 0:53 and 0:54 AM today).

User Preferences: Both instances are set to the same display timezone.

Verified that the events appearing in ES 8 have timestamps for today's date

The same events do not appear in ES 7 under the "Yesterday" filter.

Has the definition of the "Yesterday" relative time string changed in ES 8, or is there a new global setting/macro in ES 8 that overrides the  snap-to behavior for the default time picker? 

Scratching my head - but appreciate this might be a really simple solution!

[livehybrid · Accepted solution]

Hi @KevHaze 

If you use the Job Manager (Top right, Activity->Jobs) - Can you find the search being executed?

If you click into the job you should be able to see the run time displayed, can you verify these are displaying the same across the two versions?

Can you also confirm that you are using the same version of Splunk for this testing and only changed the ES version?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[KevHaze]

Just found out that the box the lab is built on hadn't updated its time using the time sync tool - this accounts for the issue with the extra results.

Thanks for the nudge in the right direction @livehybrid 

[KevHaze]

Thanks for the reply @livehybrid 

Job inspect was a great flag and shows the searches are not using the same time window.

In ES7, “yesterday” appears to:

earliestTime = 2026-04-20T00:00:00+01:00
latestTime = 2026-04-21T00:00:00+01:00

In ES8, “yesterday” shows as:

earliestTime = 2026-04-20T01:00:00+01:00
latestTime = 2026-04-21T01:00:00+01:00

So ES8 seems to be using a midnight absolute range in UTC, which becomes 01:00–01:00 local time (BST). That explains why results from 00:53 today appear in ES8 but not ES7.

The Splunk versions do differ too!

ES8 = Splunk 10.2.0
ES7 = Splunk 9.2.7

I take it these are logic changes built into upgrades?