<search>
<query>index="ourIndex" sourcetype=$stype$ABC AND Is_Service_Account="True" OR Is_Service_Account="False" earliest=-48h | eval DC=upper(DC) | eval env1=case(DC like "%Q%","QA", DC like "%DEV%","DEV", true(), "PROD") | search env1=$envPure$ AND $domainPure$ |rename DC AS domainPure | stats count </query>
<earliest>0</earliest>
<latest></latest>
</search>
If earliest=-48h and within the source code there is <earliest>0</earliest>, then if we enable an admission rule that disables All Time searches what would happen?
Hi @sle ,
if you use earliest and/or latest fields in your main search, this value override the values that you have in the Time Picker, that's not relevant.
Ciao.
Giuseppe
Hi @sle,
good for you, see next time!
let me know if I can help you more, or, please, accept one answer for the other people of Community.
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉