Searching 60 minutes prior to a time failing

[bmorgenthaler]

I'm trying to do the following query
index=main earliest=-60m latest="12/4/2019:12:31:41"
So 60 minutes before a specific events time but it errors out with the following message
Unable to parse the search: Invalid time bounds in search: start=1575493795 > end=1575484301.

Bringing up the results for the results for the last day shows me that I have an event at 12:31:40.958 PM and 12:31:40.836 PM it SHOULD return results.

[aberkow · Accepted solution]

So your issue here is that earliest=-60m is going to pull the last 60 minutes from when you run the search, not from 60 minutes prior to your latest. Your latest is from 4-5 hours ago at this point, so you're asking Splunk to run something out of it's acceptable "bounds" (aka the earliest time has to be earlier than the latest time, whereas this case is the opposite). You can confirm this by converting those epoch times to human readable (I like https://www.epochconverter.com/).

You can configure this in the date and time range selector most easily, or with more complicated token logic, but I would definitely suggest using the dropdown for something this specific.

Alternatively, you can evaluate the time difference between two times with the relative_time command, but usually later down in a search https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/DateandTimeFunctions#relative_tim....

Hope this helps!

[bmorgenthaler]

So this was for a drill down to look at an event and the prior events leading up to it. A little token evals and I came up with the following

<eval token="tok_threshold_time">"-". tostring($row.threshold$*4) ."m"</eval>

<eval token="tok_earliest">relative_time($row.recentTime$, $tok_threshold_time$)</eval>

<eval token="tok_latest">strptime($row.recentTime$,"%m/%d/%Y %H:%M:%S")</eval>

<link target="_blank">search?q=index=$row.index$%20sourcetype=$row.sourcetype$%20earliest=$tok_earliest$%20latest=$row.recentTime$</link>

Maybe not the most elegant but it works.

[jonathansinger]

This answer shows how to make latest or earliest relative to the other:
https://answers.splunk.com/answers/327158/how-to-set-latest-to-be-relative-to-earliest-1h.html