Splunk Time variable makes irritating search result with standard time Picker

[GoodApprentice]

Hallo,

i am trying to make a Dashboard that takes the time from reports of jobs.
That time is not the same as the time in Splunk. So the problem is that the time picker like 
"last 7 days" shows more than 7 days and the First and Last are not complete.
That is a Problem that i cant fix in the search code itself, i think.

Code: | eval NewTime=strptime(StartDateTZ,"%Y-%m-%d %H:%M:%S") | eval _time=NewTime | timechart span=1d@d count by TestName limit=0

[bowesmana]

Can you elaborate - when you talk about jobs, do you mean

• you are using loadjob to show the results of a saved search?
• The data that is indexed in Splunk has a timestamp in an event that is NOT the timestamp Splunk has for the event?

If the former, then the time picker should not be relevant. If the latter, then that is likely a problem with your data ingestion.

The _time variable is a fixed field that is created when the data is ingested and is key to how you find data and is inextricably linked to the search window you specify with any time picker.

If the _time field is not the same as your StartDate value and if you are saying it SHOULD be the  same, then you will need to fix how that data is ingested and how the time is extracted during ingestion from that data.

You cannot expect to find StartDate values that fall outside the time window of your search range if that time does not equal the _time field. Splunk will not pull the data from its time based buckets unless you get that _time field right.