Splunk Search

Search Time Range

dellytaniasetia
Explorer

Hi,

I have a simple question, what is the difference between earliest=-15m with earliest=-15m@s?

I could not find any diff when run my search. Any help is appreciated. Thanks

Tags (2)
0 Karma

acharlieh
Influencer

It is possible that you don't see a difference because you may not have any data that would be different. The relative time modifiers is discussed in the documents here: https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/SearchTimeModifiers#How_to_specif...

But for your specific question... Let's say you're running a search and it is right now to the sub-second exactly: 12:51:39.135

earliest=-15m would mean the earliest time for your time range is exactly 15 minutes ago, or 12:36:39.135

earliest=-15m@s means take the current time, subtract 15 minutes, and then round down to the nearest second, or in other words: 12:36:39.000

Unless you're dealing with high volumes of data that comes from devices that log down to subsecond precision it's unlikely that you would see differences between these two examples. But relative time modifiers locking down in general is a pretty handy thing to be familiar with.

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...