Why does search with subsearch fail if earliest and latest is used?

[FritzWittwer]

The following search does not produce any results:

index=* earliest="04/19/2022:15:00:00" latest="04/19/2022:17:00:00"
| fields _time, index, sourcetype | head 1
| eval mail=[| makeresults | eval mail="\"abc@cde.com\"" | return $mail]

The search and the sub search produce each one result.
The search returns one result as expected when the  the earliest and latest option in the base search are omitted.

[bowesmana]

That's strange - I ran a similar search on Splunk 8.0.1 and it gives me the correct search range, but on 8.2.1 I get this

What version of Splunk do you have?

[FritzWittwer]

I am on 8.2.3 and the time range fits:

[isoutamo]

Hi

Your search is valid. Are you sure that you have events on this time slot?

r. Ismo

[FritzWittwer]

Yes, the first search alone produces exactly one result as stated in the question. In case it is executed on a less busy instance the time range must be expanded by changing earliest and/or latests.

[isoutamo]

Can you find anything interesting from search.log via Job Inspector?

[FritzWittwer]

No, just one error message in the 1700 lines which also spears if the earliest and latest are deleted and the search runs as expected.