Splunk Search
Highlighted

earliest=0 is not overriding the time range selected in dropdown menu

Contributor

When I did a search like "index=_internal earliest=0" + "Last 15 minutes" in drop down menu I could not see below message that I usually see when time range is overridden. I was expecting to see result from all times but I could see only last 15 minutes of search result.

Your timerange was substituted based on your search string 

Tags (2)
0 Karma
Highlighted

Re: earliest=0 is not overriding the time range selected in dropdown menu

Contributor

"earliest=0" is a special case in the search language and should not be used.
Please replace all instances of "earliest=0" with "earliest=1" in search syntax.

View solution in original post

Highlighted

Re: earliest=0 is not overriding the time range selected in dropdown menu

Contributor

when do you use 0?

0 Karma