I have created Splunk query with time modifiers "earliest" and "latest" ( for eg. earliest="15/01/2022 8 am" latest="15/01/2022 10 pm" ) and also I have selected time range in the time ranger picker (for eg. 23/12/2022 8 am to 23/12/2022 10 pm)
Splunk Query:
timeformat="%m-%d-%Y %l:%M %p" earliest="15-01-2022 08:00 AM" latest="15-01-2022 10:00 PM" index="mobileApp" homepage
Time range picker values in UI:
From: 23/12/2022 8 am; To: 23/12/2022 10 pm
whenever, I click 'search' button, time range picker overrides the time modifiers earliest/latest values which are used in the Splunk query
Question:
could you please help me on overriding 'time range picker' values ( I need results between 15/01/2022 8 am to 15/01/2022 10 pm based on 'time modifiers' only)
Your answer would be greatly appreciated!
The times used for earliest and latest in your query should override the timepicker values. The job inspector should have a message saying this has happened