Splunk Search

BUG: tstats not displaying latest time modifier correctly

the_wolverine
Champion

It appears that tstats will not honor my latest value. Instead is silently uses "now"

| tstats count where index=main earliest="11/12/2015:09:00:00" latest="11/12/2015:10:00:00"

Returns a count from my earliest until now. I want latest = the date I specified.

Tags (4)
0 Karma
1 Solution

the_wolverine
Champion

Looks like this is just a bug in the UI then. The UI displays the incorrect latest time but the counts are as expected:

| tstats count where index=main earliest="11/12/2015:09:00:00" latest="11/12/2015:10:00:00"

12345 events (11/12/15 9:00:00.000 AM to 11/12/15 12:41:54.000 PM )

View solution in original post

the_wolverine
Champion

Looks like this is just a bug in the UI then. The UI displays the incorrect latest time but the counts are as expected:

| tstats count where index=main earliest="11/12/2015:09:00:00" latest="11/12/2015:10:00:00"

12345 events (11/12/15 9:00:00.000 AM to 11/12/15 12:41:54.000 PM )

MuS
SplunkTrust
SplunkTrust

Hi the_wolverine,

Yes, this is possible:

 | tstats count where earliest="11/11/2015:00:00:00" latest="11/12/2015:17:12:00" index=_internal groupby _time span=1m
 | tstats count where index=_internal earliest="11/11/2015:00:00:00" latest="11/12/2015:17:12:00" groupby _time span=1m
 | tstats count AS myCount where earliest="11/11/2015:00:00:00" latest="11/12/2015:17:12:00" index=_internal

all searches use latestTime 2015-11-12T17:12:00.000+13:00 which can be verified in the search.log
This is tested on Splunk 6.3.1 on Linux.

cheers, MuS

MuS
SplunkTrust
SplunkTrust

Yes, this is Splunk version related, because on Splunk 6.3.0 this search

 | tstats count where index=_internal earliest="11/11/2015:00:00:00" latest="11/12/2015:17:12:00"

will use latestTime 2015-11-13T09:41:22.000+13:00 and shows 2,624,870 events (11/11/15 12:00:00.000 AM to 11/13/15 9:41:22.000 AM)
all the other searches from my answer also fail to use latest correct - bug alert....

the_wolverine
Champion

So it looks like the order is important. If you run the same query with the index before the time specifiers, then the latest is not honored. If the syntax is not documented then this is a bug -- or I am misunderstanding how tstats work where time modifiers need to come first.

0 Karma

MuS
SplunkTrust
SplunkTrust

no quiet sure, because this works as well:

 | tstats count where index=_internal earliest="11/11/2015:00:00:00" latest="11/12/2015:17:12:00"

returns 256,955 events (before 12/11/2015 17:12:00.000) and uses latestTime 2015-11-12T17:12:00.000+13:00 in the search..... maybe Splunk version related?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...