Splunk Search

Why does search with subsearch fail if earliest and latest is used?

FritzWittwer
Path Finder

The following search does not produce any results:

index=* earliest="04/19/2022:15:00:00" latest="04/19/2022:17:00:00"
| fields _time, index, sourcetype | head 1
| eval mail=[| makeresults | eval mail="\"abc@cde.com\"" | return $mail]


The search and the sub search produce each one result.
The search returns one result as expected when the  the earliest and latest option in the base search are omitted.

Labels (1)
Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

That's strange - I ran a similar search on Splunk 8.0.1 and it gives me the correct search range, but on 8.2.1 I get this

bowesmana_0-1650524815014.png

What version of Splunk do you have?

 

0 Karma

FritzWittwer
Path Finder

I am on 8.2.3 and the time range fits:

FritzWittwer1_0-1650531822039.png

 

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

Your search is valid. Are you sure that you have events on this time slot?

r. Ismo

0 Karma

FritzWittwer
Path Finder

Yes, the first search alone produces exactly one result as stated in the question. In case it is executed on a less busy instance the time range must be expanded by changing earliest and/or latests.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Can you find anything interesting from search.log via Job Inspector?
0 Karma

FritzWittwer
Path Finder

No, just one error message in the 1700 lines which also spears if the earliest and latest are deleted and the search runs as expected.


0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...