Splunk Search

'earliest': '03/09/2019:17:07:00' is significantly slower than "earliest_time": "-2d" (earliest vs. earliest_time)

coreybfoulds
New Member

Greetings,

'earliest': '03/09/2019:17:07:00' is significantly slower than "earliest_time": "-2d". Is this a known issue? If so, is there a reason for this?

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

"earliest" is not special value for either the REST API or normal search. As such, what happens when you do a search with that is that it will look for any records that have that exact key and that exact value. If you are on an older version of Splunk, the default will be "all time" and it will be very slow.

If you are using the REST API? The documentation here lists the valid keys:

https://docs.splunk.com/Documentation/Splunk/7.2.4/RESTREF/RESTsearch#search.2Fjobs

(expand [POST])

All the best

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Got a little more context?

Also, what value do you see in the job inspector for earliestTime and latestTime?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.