Splunk Search

earliest=0 is not overriding the time range selected in dropdown menu

cwl
Contributor

When I did a search like "index=_internal earliest=0" + "Last 15 minutes" in drop down menu I could not see below message that I usually see when time range is overridden. I was expecting to see result from all times but I could see only last 15 minutes of search result.

Your timerange was substituted based on your search string 

Tags (2)
0 Karma
1 Solution

cwl
Contributor

"earliest=0" is a special case in the search language and should not be used.
Please replace all instances of "earliest=0" with "earliest=1" in search syntax.

View solution in original post

cwl
Contributor

"earliest=0" is a special case in the search language and should not be used.
Please replace all instances of "earliest=0" with "earliest=1" in search syntax.

pramit46
Contributor

when do you use 0?

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...