All Time Search Earliest Workload

[sle]

<search>

<query>index="ourIndex"  sourcetype=$stype$ABC AND Is_Service_Account="True" OR Is_Service_Account="False"  earliest=-48h | eval DC=upper(DC) |  eval env1=case(DC like "%Q%","QA", DC like "%DEV%","DEV", true(), "PROD")  | search env1=$envPure$ AND $domainPure$ |rename DC AS domainPure | stats count </query>


<earliest>0</earliest>


<latest></latest>


</search>

If earliest=-48h and within the source code there is <earliest>0</earliest>, then if we enable an admission rule that disables All Time searches what would happen? 

[gcusello]

Hi @sle ,

if you use earliest and/or latest fields in your main search, this value override the values that you have in the Time Picker, that's not relevant.

Ciao.

Giuseppe

[gcusello]

Hi @sle,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉