Splunk Search

'earliest': '03/09/2019:17:07:00' is significantly slower than "earliest_time": "-2d" (earliest vs. earliest_time)

coreybfoulds
New Member

Greetings,

'earliest': '03/09/2019:17:07:00' is significantly slower than "earliest_time": "-2d". Is this a known issue? If so, is there a reason for this?

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

"earliest" is not special value for either the REST API or normal search. As such, what happens when you do a search with that is that it will look for any records that have that exact key and that exact value. If you are on an older version of Splunk, the default will be "all time" and it will be very slow.

If you are using the REST API? The documentation here lists the valid keys:

https://docs.splunk.com/Documentation/Splunk/7.2.4/RESTREF/RESTsearch#search.2Fjobs

(expand [POST])

All the best

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Got a little more context?

Also, what value do you see in the job inspector for earliestTime and latestTime?

0 Karma
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...