How can I find the related search job to an error message in splunkd.log

[dietertaucher]

Hi,
we have an error message in splunkd.log.

Error Message: "Invalid value "*" for time term 'earliest'"

It happens six times at nearly the same time, every half of the hour.

Search: index=_internal event_message="Invalid value \"*\" for time term 'earliest'" component=TimeParser | table _time, event_message, source | sort - _time

2020-01-05 21:30:51.306 Invalid value "" for time term 'earliest' /opt/splunk/var/log/splunk/splunkd.log
2020-01-05 21:30:51.299 Invalid value "" for time term 'earliest' /opt/splunk/var/log/splunk/splunkd.log
2020-01-05 21:30:51.295 Invalid value "" for time term 'earliest' /opt/splunk/var/log/splunk/splunkd.log
2020-01-05 21:30:47.800 Invalid value "" for time term 'earliest' /opt/splunk/var/log/splunk/splunkd.log
2020-01-05 21:30:47.794 Invalid value "" for time term 'earliest' /opt/splunk/var/log/splunk/splunkd.log
2020-01-05 21:30:47.790 Invalid value "" for time term 'earliest' /opt/splunk/var/log/splunk/splunkd.log

I would like to find the related Splunk Search / Search Job to correct the search.
Has somebody a hint how to find the search which leads to the errors?

thank you
Dieter

[gjanders]

The audit index will have a list of all searches been run.

You could try:

index=_audit info=granted earliest

And match the time/host your seeing the errors to try to narrow down to which search, you could also write a more advanced regular expression to find something relate to earliest="" or similar...(but start simple).