Splunk Search

Why does using a time modifier in a search give a different output than selecting the time from the GUI?

Path Finder

Hi All ,

I have running a search to grab events for the last 1 hour. so in my search i am using earliest=-1h@h. It says in the following format:
n events (before current date/time)

However, if I remove the earliest from search and select the time over "Last 60 minutes" from the GUI, then it says in the following format:
n events(lasthour to currenthour)

Why is that both the output differs since they both mean the same?

0 Karma
1 Solution

Builder

Hi,

This is happening because of earliest=-1h@h.

e.g., lets say the current time is 13:40:22. Following few examples should explain you the difference:

-1h@h --> 13:00:00
-1h@m --> 13:40:00
-1h@s --> 13:40:22
-1h --> 13:40:22

Thanks!!

View solution in original post

Builder

Hi,

This is happening because of earliest=-1h@h.

e.g., lets say the current time is 13:40:22. Following few examples should explain you the difference:

-1h@h --> 13:00:00
-1h@m --> 13:40:00
-1h@s --> 13:40:22
-1h --> 13:40:22

Thanks!!

View solution in original post