Splunk Keywords definations

[basics]

HI,

I am new to Splunk and I am looking forward to learning more. I wanted to know where do I learn what keywords/code such as the following mean or do...

• earliest="-1mon@mon"
• latest="@d"
• latest="@mon"

and what does it mean when I add this in the Splunk query like this:

data = "global" earliest="-1mon@mon" latest="@d" [ search data = "global" earliest="-1mon@mon" latest="@d"]

I also have a Time Range Widget connected with this query... and the value of the output changes as I change the time range. However, (I believe) since I already defined (earliest="-1mon@mon" latest="@d") query in the search, does it make the result different? 

Please help me understand what is happening. Thank you.

[gcusello · Accepted solution]

Hi @basics,

in Splunk you can run unstructured searches (using words or strings) and/or structured searches (using fields).

In fields there are the time fields that you can set using a Time Picker or the Time Modifiers.

But, if you insert in your search the Time Modifiers, the values from the Time Picker aren't used by your search because Time Modifiers overwrite the Time Picker settings.

For more infos you can see at https://docs.splunk.com/Documentation/SCS/current/Search/Timemodifiers.

My hint is to follow the Splunk Fundamentals i course (https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html) that's a free course and the Search Tutorial (https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchTutorial/WelcometotheSearchTutorial) that help you to understand how Splunk works.

Ciao.

Giuseppe

[gcusello]

Hi @basics,

Good for you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉