Splunk Search

Time modifiers in second search after pipe

adamguzek
Explorer

On data with recent timestamps I do search:

index=test * | search earliest="1/1/1990:20:00:00"

No results found, but I was expecting all my events.

Yes I do need this timemodifier in my second search I want to narrow time appending search one after another...

Tags (1)
0 Karma
1 Solution

Ayn
Legend

First of all, that's no subsearch, that's just a second search further along the main search pipeline.

Anyway, specifying earliest is only supported in the base search. If you do

index=test earliest="1/1/1990:20:00:00"

you should be getting all your events after the specified time (as long as your time string is correctly formatted, which I admin I haven't checked).

View solution in original post

Ayn
Legend

First of all, that's no subsearch, that's just a second search further along the main search pipeline.

Anyway, specifying earliest is only supported in the base search. If you do

index=test earliest="1/1/1990:20:00:00"

you should be getting all your events after the specified time (as long as your time string is correctly formatted, which I admin I haven't checked).

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Time modifiers such as earliest only make sense in the first instance of search where events are loaded. Afterwards, you can still do filtering like this:

index=test | some magic stuff | where _time > relative_time(now(), "-10y")
index=test | some magic stuff | where _time > strptime("1990-01-01T20:00:00", "%FT%T")

adamguzek
Explorer

Can I use other time modifiers in second search - is it only earliest/latest problematic?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!