Splunk Search
Highlighted

Map earliest/latest no longer working since update to 7.1.0

Explorer

Our Splunk instance has recently (yesterday?) been updated to 7.1.0 from 7.0.0.
My queries were working perfectly before but now the map function returns the following error:

Invalid value "$TimeEarliest" for time term 'earliest'

The value is in the correct format as specified here. (i.e. %m/%d/%Y:%H:%M:%S) When I copy the actual values from the table (before I apply the map function) and put them in place of the $TimeEarliest$ and $TimeLatest$ it works perfectly.

Hence, I think something is wrong with parsing a time variable to/in the map function.
The search is as follows:

search sourcetype IN (list of sourcetypes) $Id1$ OR $Id2$ earliest=$TimeEarliest$ latest=$TimeLatest$

I have confirmed/double checked that all 4 variables are set and are in the correct format (in case of the time variables).
I also cannot find anything about this issue here nor here. (known issues and "Update to 7.1.0 read this first"). Nor anywhere on Splunk Answers either.

Anyone knows what's going wrong?

Highlighted

Re: Map earliest/latest no longer working since update to 7.1.0

Explorer

Bump?......

0 Karma
Highlighted

Re: Map earliest/latest no longer working since update to 7.1.0

Explorer

Help please 😞

0 Karma
Highlighted

Re: Map earliest/latest no longer working since update to 7.1.0

SplunkTrust
SplunkTrust

Interesting. Haven't heard this.

1) Check the job inspector and see what was input into the search itself.

2) try putting properly-escaped quotes around the TimeEarliest and TImeLatest variables.

("Properly escaped" is going to depend whether you are in a dash, a saved search, etc.)

0 Karma
Highlighted

Re: Map earliest/latest no longer working since update to 7.1.0

Explorer

Hi @DalJeanis thanks for you reply!

I've found a workaround: using _time>= "$TimeEarliest$" OR _time<="$TimeLatest$"

0 Karma
Highlighted

Re: Map earliest/latest no longer working since update to 7.1.0

Explorer

If anyone has this problem, the following solved it for me:

Instead of using "earliest" and "latest" in the search I now simply use:

_time>= "$TimeEarliest$" OR _time<="$TimeLatest$"

This seems to have fixed the issue. I am not sure whether it affects the performance of the query, but since it is already a large/slow query it doesn't really matter for me.

View solution in original post

0 Karma