Drill-down Search Earliest Latest Offset

[Splunk_Fabi]

When I edit a correlation search, I want to configure the time of the drill-down search. 

If I put "1h" in the form "Earliest Offset", it inputs the unix time stamp in milliseconds. Splunk expects the unix time stamp in seconds. Is there a workaround for this issue?

-> 

Correct would be:

[sainag_splunk]

@Splunk_Fabi Hello, which version of ES are you using? I have seen a similar bug in 7.3.2 (a fix might be on the future roadmap). If you are on 7.3.2, please file a ticket with Splunk Support to expedite the issue.

If this Helps, Please Upvote.