Splunk Search

Why does using a time modifier in a search give a different output than selecting the time from the GUI?

lohit
Path Finder

Hi All ,

I have running a search to grab events for the last 1 hour. so in my search i am using earliest=-1h@h. It says in the following format:
n events (before current date/time)

However, if I remove the earliest from search and select the time over "Last 60 minutes" from the GUI, then it says in the following format:
n events(last_hour to current_hour)

Why is that both the output differs since they both mean the same?

0 Karma
1 Solution

vganjare
Builder

Hi,

This is happening because of earliest=-1h@h.

e.g., lets say the current time is 13:40:22. Following few examples should explain you the difference:

-1h@h --> 13:00:00
-1h@m --> 13:40:00
-1h@s --> 13:40:22
-1h --> 13:40:22

Thanks!!

View solution in original post

vganjare
Builder

Hi,

This is happening because of earliest=-1h@h.

e.g., lets say the current time is 13:40:22. Following few examples should explain you the difference:

-1h@h --> 13:00:00
-1h@m --> 13:40:00
-1h@s --> 13:40:22
-1h --> 13:40:22

Thanks!!

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...