Splunk Search

All Time shos results in last 24 hour, but Yesterday does not

jeremyhagand61
Communicator

Hi,

 

I'm running Splunk Free and have a data source which has events in the last 24 hours. When I run a search for All Time, event are shown in the index, but when I search for Yesterday I get no results.

The only other thing to note is that I only just created the index the data is in because I am expermenting with a new data source. Not sure if this affects anything.

Anyone got an explanation for this?

Labels (1)
0 Karma
1 Solution

jeremyhagand61
Communicator
Tags (1)
0 Karma

jeremyhagand61
Communicator

PEBKAC

Tags (1)
0 Karma

to4kawa
Ultra Champion

https://docs.splunk.com/Documentation/Splunk/8.0.4/Admin/Propsconf

DATETIME_CONFIG = CURRENT

It could have been like this. 

0 Karma