Splunk Search

Search Time Range

dellytaniasetia
Explorer

Hi,

I have a simple question, what is the difference between earliest=-15m with earliest=-15m@s?

I could not find any diff when run my search. Any help is appreciated. Thanks

Tags (2)
0 Karma

acharlieh
Influencer

It is possible that you don't see a difference because you may not have any data that would be different. The relative time modifiers is discussed in the documents here: https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/SearchTimeModifiers#How_to_specif...

But for your specific question... Let's say you're running a search and it is right now to the sub-second exactly: 12:51:39.135

earliest=-15m would mean the earliest time for your time range is exactly 15 minutes ago, or 12:36:39.135

earliest=-15m@s means take the current time, subtract 15 minutes, and then round down to the nearest second, or in other words: 12:36:39.000

Unless you're dealing with high volumes of data that comes from devices that log down to subsecond precision it's unlikely that you would see differences between these two examples. But relative time modifiers locking down in general is a pretty handy thing to be familiar with.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...