Splunk Search

Why is Splunk not throwing an error when the time range I selected for my search is between a past and a future date?

m_vivek
Path Finder

I have a basic search like this:

 index=pqr host=xyz* NOT TYPE="*ABCDE*" | fields X, Y |timechart limit=0 span=10m count, avg(X) by Y

And I search it using the date range. Today, I tried choosing a date in the past and another one into the future . I expected to be thrown an error, but the search ran without errors. Why? Today is the 3rd. The date I chose was the 4th.

alt text

0 Karma
1 Solution

jeffland
SplunkTrust
SplunkTrust

Why would you expect an error? The time range you search on (and more importantly, it's relation to the current time) is arbitrary. Splunk will search on data from time X to time Y, regardless of the current time.

You will get an error however when you try to index data that is either too old or too far in the future. Generally, it is perfectly legal to index data with a future timestamp (in standard configuration, this means two days ahead). These settings are configured in props.conf with MAX_DAYS_AGO and MAX_DAYS_HENCE.

View solution in original post

woodcock
Esteemed Legend

Because data is sometimes mis-timestamped, it is necessary to search for "impossible" things such as events that "have not yet happened". The capability to search into the future is a huge benefit when trying to track down things like wrong TZ being applied to timestamps.

jeffland
SplunkTrust
SplunkTrust

Why would you expect an error? The time range you search on (and more importantly, it's relation to the current time) is arbitrary. Splunk will search on data from time X to time Y, regardless of the current time.

You will get an error however when you try to index data that is either too old or too far in the future. Generally, it is perfectly legal to index data with a future timestamp (in standard configuration, this means two days ahead). These settings are configured in props.conf with MAX_DAYS_AGO and MAX_DAYS_HENCE.

m_vivek
Path Finder

Ok. Thanks. I think I now have a better understanding. I was expecting an error because, there was no data present for the future date, and I thought I would get something like 'out of range chosen or invalid dates chosen.'

0 Karma

jeffland
SplunkTrust
SplunkTrust

Why should you get an error when you search in a timerange that has no data? You'll simply get zero results. It's not "illegal" or somehow "undefined" what happens in that case.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...