Splunk Search

earliest=0 is not overriding the time range selected in dropdown menu

cwl
Contributor

When I did a search like "index=_internal earliest=0" + "Last 15 minutes" in drop down menu I could not see below message that I usually see when time range is overridden. I was expecting to see result from all times but I could see only last 15 minutes of search result.

Your timerange was substituted based on your search string 

Tags (2)
0 Karma
1 Solution

cwl
Contributor

"earliest=0" is a special case in the search language and should not be used.
Please replace all instances of "earliest=0" with "earliest=1" in search syntax.

View solution in original post

cwl
Contributor

"earliest=0" is a special case in the search language and should not be used.
Please replace all instances of "earliest=0" with "earliest=1" in search syntax.

pramit46
Contributor

when do you use 0?

0 Karma
Get Updates on the Splunk Community!

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...