Splunk Search

Earliest time and latest time

prithviraj
New Member

I'm doing Splunk search at 5 minute intervals. Getting data every 5 minutes. For example, 

earliest="07/10/2021:07:35:00" AND latest="07/10/2021:07:40:00", next interval will be

earliest="07/10/2021:07:40:00" AND latest="07/10/2021:07:45:00". 

 

So the question is, when we have a log at exactly 07:40:00, will the log duplicate on both the intervals?

I've done some analysis on the same. Splunk will provide the data in milliseconds, 07:40:00.000

The millisecond position can go up to, "07:40:00.000000". When I try to search this, the log time is considered as 07:39:59.999 but it's going in to the 07:40 to 07:45 interval and is not being duplicated. 

 

Why is "07:40:00.000000" considered as 07:39:59.999? If it is considered as 07:39:59.999 why is it going to the latter time interval? Is this splunk's mechanism to avoid duplication? Can someone please explain how earliest time and latest time is considered by splunk in milliseconds when doing the search?

Labels (1)
Tags (3)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @prithviraj 

splunk does not apply any mechanism to avoid showing duplicate events. If the duplicate events happen to ingest to Splunk you might notice same events at different time periods this could happen on source system/intermediate forwarder layer this is nothing to do with your case i guess. If you are finding same event twice in Splunk then look at their _indextime it won't visible in UI unless you query it explicitly.

Coming to earliest, latest time they works on _time which is the actual time calculated when data was ingested once written to indexers this will not change that keeps adjusting to Timezone settings of user preference. Lets say event seen between 07:30 (earliest) to 07:34.00.1234566 (latest), when you search between 07.34 to 07.39 it does show, however if you search between 07.35 to 07.40 it won't show here.

---

An upvote would be appreciated if this reply helps you and Accept it.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...