Splunk Search

Instruct splunk search to search from oldest event first instead of newest?

justinjohn83
Explorer

If I run "search latest=1/5/2011:0:0:0 | head limit=1" the results are returned immediately. But if I run "search earliest=1/5/2011:0:0:0 | reverse | head limit=1" or "search earliest=1/5/2011:0:0:0 | tail limit=1" or "search earliest=1/5/2011:0:0:0 | sort + _time | head limit=1" the results take forever because it is still executing the search by first looking at the new events first. Is there a way to instruct splunk to begin searching from a specific time forward instead of backwards from the current time?

Thanks,

Justin

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

There is not. It is probably worth filing an Enhancement Request with Splunk, as it's not the first time I'm sure. When you file, be sure to describe your use case.

View solution in original post

0 Karma

I-Man
Communicator

I hope you filed an enhancement request because that function would be very convenient.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

There is not. It is probably worth filing an Enhancement Request with Splunk, as it's not the first time I'm sure. When you file, be sure to describe your use case.

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...