What's the relationship between api_lt/api_et and search_lt/search_et in _audit?

[danielbb]

Are these fields mutually exclusive? I'm not sure about the relation between these four fields.

[Prewin27]

@danielbb 

I dont think there is any public document available from Splunk for this field-to-field explanations.
They doesn't seem mutually exclusive, as it can be same or differ depends on the search.

Also you can refer - #https://community.splunk.com/t5/Splunk-Search/index-audit-contents/m-p/338588

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[livehybrid]

Hi @danielbb 

My understanding on this (and I'd also be pleased if someone can confirm!) is that api_lt and api_et represent the time parameters provided by the user in the time picker or API when running a search, but search_lt and search_et represent the actual earliest and latest time used by Splunk during the search execution.

If the user specifies an earliest/latest in the search for example, this would override the time picker values (api_et/api_lt). If not earliest/latest in the search then search_et/lt become api_lt.

I dont recall seeing docs around this though so if someone can find any please let me know 🙂

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[tscroggins]

Hi @livehybrid,

api_lt and api_et should correspond to the UI time range or the earliest_time and latest_time search API paramters as you noted, although I don't know if this is publicly documented.

Similarly, api_index_et and api_index_lt should correspond to the index_earliest and index_latest search API parameters.

search_lt and search_et should correspond to the computed epoch second values from the earliest, latest, and other time modifiers if they're provided as part of the base search:

index=main foo earliest=-24h@h latest=now

index=main foo starttime=06/29/2025:20:50:00

The audit log doesn't appear to capture the values passed to _index_earliest and _index_latest or translate them to api_index_et and api_index_lt, unfortunately, but they should be present in the search text.