Splunk Search

Time modifiers in second search after pipe

adamguzek
Explorer

On data with recent timestamps I do search:

index=test * | search earliest="1/1/1990:20:00:00"

No results found, but I was expecting all my events.

Yes I do need this timemodifier in my second search I want to narrow time appending search one after another...

Tags (1)
0 Karma
1 Solution

Ayn
Legend

First of all, that's no subsearch, that's just a second search further along the main search pipeline.

Anyway, specifying earliest is only supported in the base search. If you do

index=test earliest="1/1/1990:20:00:00"

you should be getting all your events after the specified time (as long as your time string is correctly formatted, which I admin I haven't checked).

View solution in original post

Ayn
Legend

First of all, that's no subsearch, that's just a second search further along the main search pipeline.

Anyway, specifying earliest is only supported in the base search. If you do

index=test earliest="1/1/1990:20:00:00"

you should be getting all your events after the specified time (as long as your time string is correctly formatted, which I admin I haven't checked).

martin_mueller
SplunkTrust
SplunkTrust

Time modifiers such as earliest only make sense in the first instance of search where events are loaded. Afterwards, you can still do filtering like this:

index=test | some magic stuff | where _time > relative_time(now(), "-10y")
index=test | some magic stuff | where _time > strptime("1990-01-01T20:00:00", "%FT%T")

adamguzek
Explorer

Can I use other time modifiers in second search - is it only earliest/latest problematic?

0 Karma
Get Updates on the Splunk Community!

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...