Splunk Search

Why are Time Modifiers not working with SPL CLI?

tracieed_nord
Explorer

Doing a search on CLI with time range modifiers does not seem to work.

I have tried earliest_time/latest_time and index_earliest/index_latest.

I have tired formatting mm/dd/yyy and yyyy-mm-dd.

Format of command is: /opt/splunk/bin/splunk search 'search details' earliest_time=yyyy-mm-dd latest_time=yyyy-mm-dd.

The search works as expected w/out the time range modifiers - and of course works via web. When I try this earliest_time=2018-05-01 latest_time=2018-06-01 max_out=0 I get results from 09/13??

I am running this on the search head in a distributed environment.

Tags (2)
0 Karma

Vijeta
Influencer

you need to convert time using strftime and then compare with earliest and latest instead of earliest_time and latest_time
eval time = strftime(, "%Y-%m-%d")

0 Karma

tracieed_nord
Explorer

As far as I know, "earliest/latest" are not supported in CLI searches - according to the documentation? And why do I have to convert?
Thanx

0 Karma

Vijeta
Influencer

The conversion needs to be done as the time values is considered in seconds format. You can use

eval start_time = strftime("2018-05-01", "%Y-%m-%d") | eval end_time=strftime("2018-06-01", "%Y-%m-%d")|
where ( _time > start_time and _time < end_time)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...