what does timeDiff_type field in es_notable_events collection does?

[anands4]

I was trying to get report of top notable events created in splunk. Below is the search query for it:
| es_notable_events | search timeDiff_type=current | stats sparkline(sum(count),30m) as sparkline,sum(count) as count by rule_name | sort 100 - count

I need to know what is timeDiff_type=current means? If I put timeDiff_type=* , I am getting huge increase in count of data.

Different question related to same 'es_notable_events' : The output for the query that I am putting is fixed. If I am changing the time-picker to past 1 week, Iam getting the same data. Same output is shown If I change the timings. Why the data is not changing ?

[harsmarvania57]

Hi,

es_notable_events is KVStore and it stores notable event information for last 48 hours, for more details what information stores in es_notable_events kvstore, have look at ESS - Notable Events scheduled search which runs at every 10 minutes, search last 48 hours data from notable macro, do some filtering and create field called timeDiff_type and assign value as current if notable generated in last 24 hours and assigns value as historical if notable generated between last 24 and last 48 hours and store that information with other fields in es_notable_events kvstore.

[dharshini]

Did you manage to find an answer? As I am stuck here as well.

Thanks.