Splunk Search

'earliest': '03/09/2019:17:07:00' is significantly slower than "earliest_time": "-2d" (earliest vs. earliest_time)

coreybfoulds
New Member

Greetings,

'earliest': '03/09/2019:17:07:00' is significantly slower than "earliest_time": "-2d". Is this a known issue? If so, is there a reason for this?

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

"earliest" is not special value for either the REST API or normal search. As such, what happens when you do a search with that is that it will look for any records that have that exact key and that exact value. If you are on an older version of Splunk, the default will be "all time" and it will be very slow.

If you are using the REST API? The documentation here lists the valid keys:

https://docs.splunk.com/Documentation/Splunk/7.2.4/RESTREF/RESTsearch#search.2Fjobs

(expand [POST])

All the best

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Got a little more context?

Also, what value do you see in the job inspector for earliestTime and latestTime?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...