Splunk Search

Search Time Range

dellytaniasetia
Explorer

Hi,

I have a simple question, what is the difference between earliest=-15m with earliest=-15m@s?

I could not find any diff when run my search. Any help is appreciated. Thanks

Tags (2)
0 Karma

acharlieh
Influencer

It is possible that you don't see a difference because you may not have any data that would be different. The relative time modifiers is discussed in the documents here: https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/SearchTimeModifiers#How_to_specif...

But for your specific question... Let's say you're running a search and it is right now to the sub-second exactly: 12:51:39.135

earliest=-15m would mean the earliest time for your time range is exactly 15 minutes ago, or 12:36:39.135

earliest=-15m@s means take the current time, subtract 15 minutes, and then round down to the nearest second, or in other words: 12:36:39.000

Unless you're dealing with high volumes of data that comes from devices that log down to subsecond precision it's unlikely that you would see differences between these two examples. But relative time modifiers locking down in general is a pretty handy thing to be familiar with.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...