Hi,
When I search using the Python API and provide earliest_time
and latest_time
, I guess it is an inclusive range, but can anyone confirm with documentation?
Thanks!
Earliest is inclusive, latest is exclusive. In math terms, [earliest, latest)
.
It has to be one of each, else events would be missed or doubled if you schedule a search over an hour time range every hour.
Logically, -d@d
to @d
then gives you "everything with a date of yesterday and any time" - sounds very sane to me.
The docs aren't very explicit on that, the bottom example backs this up here though: http://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Specifytimemodifiersinyoursearch#Examples_o...
Earliest is inclusive, latest is exclusive. In math terms, [earliest, latest)
.
It has to be one of each, else events would be missed or doubled if you schedule a search over an hour time range every hour.
Logically, -d@d
to @d
then gives you "everything with a date of yesterday and any time" - sounds very sane to me.
The docs aren't very explicit on that, the bottom example backs this up here though: http://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Specifytimemodifiersinyoursearch#Examples_o...