Can I specify earliest time including subseconds?

[mslvrstn]

Is it possible to specify earliest= at subsecond granularity?

Thanks for your help.

[Stephen_Sorkin · Accepted solution]

Yes.

[splunk@MrT ~]$ splunk/bin/splunk search 'index=_internal earliest=1299878273 latest=1299878274 | stats count'
INFO: Your timerange was substituted based on your search string
count
-----
   46

[splunk@MrT ~]$ splunk/bin/splunk search 'index=_internal earliest=1299878273.651 latest=1299878274 | stats count'
INFO: Your timerange was substituted based on your search string
count
-----
    4

[mslvrstn]

Awesome! Thanks!