Why is Splunk not throwing an error when the time range I selected for my search is between a past and a future date?

[m_vivek]

I have a basic search like this:

 index=pqr host=xyz* NOT TYPE="*ABCDE*" | fields X, Y |timechart limit=0 span=10m count, avg(X) by Y

And I search it using the date range. Today, I tried choosing a date in the past and another one into the future . I expected to be thrown an error, but the search ran without errors. Why? Today is the 3rd. The date I chose was the 4th.

[woodcock]

Because data is sometimes mis-timestamped, it is necessary to search for "impossible" things such as events that "have not yet happened". The capability to search into the future is a huge benefit when trying to track down things like wrong TZ being applied to timestamps.

[jeffland · Accepted solution]

Why would you expect an error? The time range you search on (and more importantly, it's relation to the current time) is arbitrary. Splunk will search on data from time X to time Y, regardless of the current time.

You will get an error however when you try to index data that is either too old or too far in the future. Generally, it is perfectly legal to index data with a future timestamp (in standard configuration, this means two days ahead). These settings are configured in props.conf with MAX_DAYS_AGO and MAX_DAYS_HENCE.

[m_vivek]

Ok. Thanks. I think I now have a better understanding. I was expecting an error because, there was no data present for the future date, and I thought I would get something like 'out of range chosen or invalid dates chosen.'

[jeffland]

Why should you get an error when you search in a timerange that has no data? You'll simply get zero results. It's not "illegal" or somehow "undefined" what happens in that case.