Cannot use earliest and latest for _time field newly converted from other field ?

[sieutruc]

Hello,

When i trigger a search like:

host="win20_oslo-ifs_CC-DC" index="sqlobj" | multikv | eval BusinessEpoch=strptime(BusinessDay,"%m/%d/%Y %I:%M:%S %p") | eval _time=BusinessEpoch  | table _time

It gives a table of _time field that is converted from BusinessDay, but if i use:

host="win20_oslo-ifs_CC-DC" index="sqlobj" | multikv | eval BusinessEpoch=strptime(BusinessDay,"%m/%d/%Y %I:%M:%S %p") | eval _time=BusinessEpoch  | search earliest=-1d latest=now | table _time

I've got no result , and i tried several times by changing the value of earliest or lastest but couldn't be successful. Can you suggest me what to do ?

[sideview · Accepted solution]

The earliest and latest searchterms will only function in the search command when it's the initial search command in the pipeline. This is because those searchterms are really just a shorthand way to submit the "earliest" and "latest" arguments to the Splunk search API, back when the search is being dispatched initially.

So to filter by time further down in the search pipeline, I would use the "relative_time" function that's available in the eval and where commands.

Specifically :

| where _time>=relative_time(now(),"-1h") AND _time<now()

[vbumgarner]

So... side question...

Is there any way to "reset" the "search timeframe" so that all the "commands that bin" will honor a new "search timeframe" instead of the timeframe used in the original query?

[sieutruc]

Thanks, yes i did one of both separately, but got no success too

[Ayn]

Did you try without "lastest"? Because that's a typo - it should be "latest"...