Splunk Search

Earliest Time not showing the correct results

neerajs_81
Contributor

Hi All,  I am confused as in why earliest time modifier is not working out in my case ? Someone pls clarify why is splunk displaying the results this way ?

Below is my search 

 

(index=linux source="/var/log/secure" "Failed password") earliest=-1d
| stats latest(_time) as _time, values(host), values(dest_ip), values(source), values(src_ip), values(src), dc(src_ip) as srcIpCount, dc(src) as srcCount, values(user), dc(user) as userCount, count as failures by src_ip dest
| rename values(*) as *
| table _time dest dest_ip host source srcIpCount src_ip srcCount src userCount user failures
| where failures>10 AND userCount>1

 

This does not show any results with earliest = -1d ( Today being Nov 2 2021)

Now if i change earliest=-7d , then it shows results where _time = Nov 1 2021 which is yesterday.  Below screenshot.    Why didn't earliest = -1d or even -2d show these results ?  What is making -7d pick these up but not -1d or -2d ?

neerajs_81_0-1635843453876.png

 




Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You only get results when (according to your where clause) you have accumulated more than 10 failures and more than 1 user within your time period i.e. there aren't sufficient failures and users until you expand the timeframe to 7 days.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You only get results when (according to your where clause) you have accumulated more than 10 failures and more than 1 user within your time period i.e. there aren't sufficient failures and users until you expand the timeframe to 7 days.

Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...