Splunk Search

How can I find the related search job to an error message in splunkd.log

dietertaucher
New Member

Hi,
we have an error message in splunkd.log.

Error Message: "Invalid value "*" for time term 'earliest'"

It happens six times at nearly the same time, every half of the hour.

Search: index=_internal event_message="Invalid value \"*\" for time term 'earliest'" component=TimeParser | table _time, event_message, source | sort - _time

2020-01-05 21:30:51.306 Invalid value "" for time term 'earliest' /opt/splunk/var/log/splunk/splunkd.log
2020-01-05 21:30:51.299 Invalid value "
" for time term 'earliest' /opt/splunk/var/log/splunk/splunkd.log
2020-01-05 21:30:51.295 Invalid value "" for time term 'earliest' /opt/splunk/var/log/splunk/splunkd.log
2020-01-05 21:30:47.800 Invalid value "
" for time term 'earliest' /opt/splunk/var/log/splunk/splunkd.log
2020-01-05 21:30:47.794 Invalid value "" for time term 'earliest' /opt/splunk/var/log/splunk/splunkd.log
2020-01-05 21:30:47.790 Invalid value "
" for time term 'earliest' /opt/splunk/var/log/splunk/splunkd.log

I would like to find the related Splunk Search / Search Job to correct the search.
Has somebody a hint how to find the search which leads to the errors?

thank you
Dieter

Tags (1)
0 Karma

gjanders
SplunkTrust
SplunkTrust

The audit index will have a list of all searches been run.

You could try:

index=_audit info=granted earliest

And match the time/host your seeing the errors to try to narrow down to which search, you could also write a more advanced regular expression to find something relate to earliest="" or similar...(but start simple).

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...