When conducting searches, we have observed that the SPL searches were not working based on the "earliest" time range in the SPL search itself. It only worked when we choose the configured presents.
if i am seraching the index with earliest=-7d and searching with the time stamp for last 24 hours it should give the result for last 7 days but am getting the result for last 24 hours.
That is the way it is supposed to work, but we can't debug this problem without seeing your code. Make sure the "earliest" keyword is before the first pipe (|).
--- If this reply helps you, Karma would be appreciated.
