All Time shos results in last 24 hour, but Yesterday does not

[jeremyhagand61]

Hi,

I'm running Splunk Free and have a data source which has events in the last 24 hours. When I run a search for All Time, event are shown in the index, but when I search for Yesterday I get no results.

The only other thing to note is that I only just created the index the data is in because I am expermenting with a new data source. Not sure if this affects anything.

Anyone got an explanation for this?

[jeremyhagand61 · Accepted solution]

PEBKAC

[to4kawa]

https://docs.splunk.com/Documentation/Splunk/8.0.4/Admin/Propsconf

DATETIME_CONFIG = CURRENT

It could have been like this.