Splunk Search

earliest=0 is not overriding the time range selected in dropdown menu

cwl
Contributor

When I did a search like "index=_internal earliest=0" + "Last 15 minutes" in drop down menu I could not see below message that I usually see when time range is overridden. I was expecting to see result from all times but I could see only last 15 minutes of search result.

Your timerange was substituted based on your search string 

Tags (2)
0 Karma
1 Solution

cwl
Contributor

"earliest=0" is a special case in the search language and should not be used.
Please replace all instances of "earliest=0" with "earliest=1" in search syntax.

View solution in original post

cwl
Contributor

"earliest=0" is a special case in the search language and should not be used.
Please replace all instances of "earliest=0" with "earliest=1" in search syntax.

pramit46
Contributor

when do you use 0?

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...