Map earliest/latest no longer working since update to 7.1.0

[koenV]

Our Splunk instance has recently (yesterday?) been updated to 7.1.0 from 7.0.0.
My queries were working perfectly before but now the map function returns the following error:

Invalid value "$TimeEarliest" for time term 'earliest'

The value is in the correct format as specified here. (i.e. %m/%d/%Y:%H:%M:%S) When I copy the actual values from the table (before I apply the map function) and put them in place of the $TimeEarliest$ and $TimeLatest$ it works perfectly.

Hence, I think something is wrong with parsing a time variable to/in the map function.
The search is as follows:

search sourcetype IN (list of sourcetypes) $Id1$ OR $Id2$ earliest=$TimeEarliest$ latest=$TimeLatest$

I have confirmed/double checked that all 4 variables are set and are in the correct format (in case of the time variables).
I also cannot find anything about this issue here nor here. (known issues and "Update to 7.1.0 read this first"). Nor anywhere on Splunk Answers either.

Anyone knows what's going wrong?

[koenV · Accepted solution]

If anyone has this problem, the following solved it for me:

Instead of using "earliest" and "latest" in the search I now simply use:

_time>= "$TimeEarliest$" OR _time<="$TimeLatest$"

This seems to have fixed the issue. I am not sure whether it affects the performance of the query, but since it is already a large/slow query it doesn't really matter for me.

[DalJeanis]

Interesting. Haven't heard this.

1) Check the job inspector and see what was input into the search itself.

2) try putting properly-escaped quotes around the TimeEarliest and TImeLatest variables.

("Properly escaped" is going to depend whether you are in a dash, a saved search, etc.)

[koenV]

Hi @DalJeanis thanks for you reply!

I've found a workaround: using _time>= "$TimeEarliest$" OR _time<="$TimeLatest$"

[koenV]

Bump?......

[koenV]

Help please 😞