Splunk Search
Highlighted

Why does using a time modifier in a search give a different output than selecting the time from the GUI?

Path Finder

Hi All ,

I have running a search to grab events for the last 1 hour. so in my search i am using earliest=-1h@h. It says in the following format:
n events (before current date/time)

However, if I remove the earliest from search and select the time over "Last 60 minutes" from the GUI, then it says in the following format:
n events(lasthour to currenthour)

Why is that both the output differs since they both mean the same?

0 Karma
Highlighted

Re: Why does using a time modifier in a search give a different output than selecting the time from the GUI?

Builder

Hi,

This is happening because of earliest=-1h@h.

e.g., lets say the current time is 13:40:22. Following few examples should explain you the difference:

-1h@h --> 13:00:00
-1h@m --> 13:40:00
-1h@s --> 13:40:22
-1h --> 13:40:22

Thanks!!

View solution in original post

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.