Splunk Search

Earliest Time not showing the correct results

neerajs_81
Contributor

Hi All,  I am confused as in why earliest time modifier is not working out in my case ? Someone pls clarify why is splunk displaying the results this way ?

Below is my search 

 

(index=linux source="/var/log/secure" "Failed password") earliest=-1d
| stats latest(_time) as _time, values(host), values(dest_ip), values(source), values(src_ip), values(src), dc(src_ip) as srcIpCount, dc(src) as srcCount, values(user), dc(user) as userCount, count as failures by src_ip dest
| rename values(*) as *
| table _time dest dest_ip host source srcIpCount src_ip srcCount src userCount user failures
| where failures>10 AND userCount>1

 

This does not show any results with earliest = -1d ( Today being Nov 2 2021)

Now if i change earliest=-7d , then it shows results where _time = Nov 1 2021 which is yesterday.  Below screenshot.    Why didn't earliest = -1d or even -2d show these results ?  What is making -7d pick these up but not -1d or -2d ?

neerajs_81_0-1635843453876.png

 




Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You only get results when (according to your where clause) you have accumulated more than 10 failures and more than 1 user within your time period i.e. there aren't sufficient failures and users until you expand the timeframe to 7 days.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You only get results when (according to your where clause) you have accumulated more than 10 failures and more than 1 user within your time period i.e. there aren't sufficient failures and users until you expand the timeframe to 7 days.

Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...