earliest=-1w does not work

[GauriSplunk]

Hi,
I have the following simple search.
sourcetype=ib:reserved1 source=ib:user:user_login index=ib_security earliest=-1w

When i run this search i do not get results. But when i remove the earliest command, I get the results.
All the results have todays date as time. So it should return result when I put earliest as 1 week back.

Why is earliest not working

Thanks

[MuS]

Running this search on Splunk 6.3.1 on Linux works:

index="_internal" sourcetype="splunkd" source="*metrics.log" earliest=-1w

It will return 450,072 events (before 11/10/15 9:19:03.378 AM)

[GauriSplunk · Accepted solution]

the date on my events was greater than current date. (maybe the date on that machine was wrongly set).
So I believe it takes latest as now by default.
so earliest=-1w and latest = now , it didnt match the events.

If it didnt take any default value for latest, it would have worked.

[MuS]

Hi GauriSplunk,

I converted your comment to an answer since it looks like you solved your time stamp issue/problem by setting a latest value in the search. Is that correct?

cheers, MuS

[GauriSplunk]

yes. thanks

[woodcock]

I am sorry, I was careless and made a silly mistake in my testing and retract my confirmation of this problem. I am unable to reproduce it.

[sundareshr]

Does putting around source & sourcetype make any difference?

sourcetype="ib:reserved1" source="ib:user:user_login" index="ib_security" earliest=-1w

[Richfez]

No, I tried again with and without quotes around various pieces but just can't make it misbehave. I've also tried the various pieces individually and in various combinations. If GauriSplunk can reproduce this at will, I expect Splunk Support will definately want to take a look at this.