Splunk Search

Confused on Time modifiers in Searches

chrisboy68
Contributor

Hi,

I must be missing something. I have a simple search using a time modifier:

index=MyIndex earliest=-30m 

My expectation is when I search, the results will be searched and returned only over the last 30 minutes of events. When I use the time picker and set to ALL TIME, it still only returns the last 30 minutes but searches over ALL EVENTS? Is this the correct behavior?

I looked at the job log and it did have the earliest event as the first event in the index (ALL TIME) with the time modifier. Read this a few times, https://docs.splunk.com/Documentation/Splunk/8.0.3/Search/Specifytimemodifiersinyoursearch and didn't see any verbiage to this behavior.

Thank you!

Chris

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The verbiage you seek is there at that link.

A time range that you specify in the Search bar, or in a saved search, overrides the time range that is selected in the Time Range Picker.

If you specify earliest=-30m in your query then the time picker should be ignored. If that's not the case then you may have found a bug and should open a support case.

---
If this reply helps you, Karma would be appreciated.
0 Karma

chrisboy68
Contributor

Maybe I'm not explaining it correctly. The events being returned are always within the time modifier on the search.

Try this(for those watching): index=main earliest=-30m for last 4 hours and look at the job inspector for earliestTime, then do the same for ALL Time. The earliestTime is the first event of the index, which tells me splunk is searching all the events and not limiting to a 30 min window based on _time. It takes much longer too, I usually kill it.

Tx

Chris

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's what I understood and is not expected behavior. Please open a support case.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...