Splunk Search

What does <time_unit> default to?

pm771
Communicator

Because of a typo we had the following in our query:

 

 

earliest=-1@d

 

 

Since Splunk query actually ran I assumed that some kind of default value had been used.

I could not find such details in docs.

 

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Time is stored in seconds so -1 is previous second (from now),  @d will align to the beginning of the day, so-1@d is midnight last night unless you run the search within the first second of today, in which case it will be midnight on the previous night.

View solution in original post

pm771
Communicator

I tried 

 

index= 
earliest=-600@m
| stats max(_time) as maxT min(_time) as minT
| eval maxtime=strftime(maxT,"%Y-%m-%dT%H:%M:%S.%Q"), mintime=strftime(minT,"%Y-%m-%dT%H:%M:%S.%Q")

 

and got back 10 min of events as expected based on your explanation.

0 Karma

shivanshu1593
Builder

Hello,

You are correct in identifying its behavior. When you write earliest=-1@d, it gives you the results on the basis of @d, which is every single result from the beginning of the day. -1 as ITWhisperer correctly pointed out accounts for a second and has no visible impact. 

shivanshu1593_0-1675872547023.png

 




Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

As I said, -1 is not ignored, it is just that it has no appreciable impact, unless going back 1 second takes you back to the previous day. Essentially, without a time unit, seconds is assumed / defaulted.

shivanshu1593
Builder

Hello,

Thank you for correcting me and letting us know the correct behavior. I didn't know the correct fact here. I've updated the answer as well. 🙂

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Time is stored in seconds so -1 is previous second (from now),  @d will align to the beginning of the day, so-1@d is midnight last night unless you run the search within the first second of today, in which case it will be midnight on the previous night.

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...