Splunk Search

Why is this "earliest" not working?

zachsisinst
Explorer

index=myindex 
| eval createdepoch = strptime(created, "%Y-%m-%d")
| eval _time = createdepoch
| search earliest=-90d@d 
| table _time

This returns no results,  Can anyone tell me why this wouldn't work?  

Labels (1)
0 Karma

somesoni2
Revered Legend

The time range filters (earliest/latest/_index_earliest/_index_latest etc) work on base search (portion before first pipe, for both main search and subsearch) only. Unless there is a field called "earliest" returned by your base search, your query will always fail.

Assuming you want to filter result based on newly calculated _time field, try something like this:

index=myindex 
| eval createdepoch = strptime(created, "%Y-%m-%d")
| eval _time = createdepoch
| where _time>=relative_time(now(),"-90d@d")
| table _time
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...