Splunk Search

Splunk search earliest and latest in Splunk search

jaibalaraman
Path Finder

Splunk search 

" EventCode="4688" AND earliest="5/8/2024:10:07:20" latest="5/8/2024:10:17:20 " 

Could you please the time search is correct 

Labels (1)
Tags (1)
0 Karma

thahir
Path Finder

@jaibalaraman , your searches return a consistent set of results regardless of the time zone you are in.

0 Karma

thahir
Path Finder

@jaibalaraman search can be in any time zone. can you elaborate your question what you need exactly

0 Karma

jaibalaraman
Path Finder

Hi 

I am trying to use earliest and latest on Date time 

Could you please advise the right format to use , i am not sure the below spl format is correct

Event Code="1234" AND earliest="5/8/2024:10:07:20" latest="5/8/2024:10:17:20

0 Karma

thahir
Path Finder

hi @jaibalaraman , 

 

You can specify an exact time such as earliest="10/5/2021:20:00:00", or a relative time such as earliest=-h or latest=@w6.

When specifying relative time, you can use the now modifier to refer to the current time.

Tags (1)
0 Karma

apietsch
Splunk Employee
Splunk Employee

According to the documentation for search time modifiers you should be correct. Although example 4 and 5 on that page uses a different time format. Try the format from the examples.

---------------------
Chaos Smoother | Data Wrangler
0 Karma

jaibalaraman
Path Finder

Also the search can be done in  UTC or any time zone'

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...