'earliest': '03/09/2019:17:07:00' is significantly slower than "earliest_time": "-2d" (earliest vs. earliest_time)

[coreybfoulds]

Greetings,

'earliest': '03/09/2019:17:07:00' is significantly slower than "earliest_time": "-2d". Is this a known issue? If so, is there a reason for this?

[chrisyounger]

"earliest" is not special value for either the REST API or normal search. As such, what happens when you do a search with that is that it will look for any records that have that exact key and that exact value. If you are on an older version of Splunk, the default will be "all time" and it will be very slow.

If you are using the REST API? The documentation here lists the valid keys:

https://docs.splunk.com/Documentation/Splunk/7.2.4/RESTREF/RESTsearch#search.2Fjobs

(expand [POST])

All the best

[martin_mueller]

Got a little more context?

Also, what value do you see in the job inspector for earliestTime and latestTime?