Splunk Search

which overrides first either time modifier or time range picker?

jmohan1984
New Member

I have created Splunk query with time modifiers "earliest" and "latest" ( for eg. earliest="15/01/2022 8 am" latest="15/01/2022 10 pm" ) and also I have selected time range in the time ranger picker (for eg. 23/12/2022 8 am to 23/12/2022 10 pm)

Splunk Query:

 

timeformat="%m-%d-%Y %l:%M %p" earliest="15-01-2022 08:00 AM" latest="15-01-2022 10:00 PM" index="mobileApp"  homepage

 

 

Time range picker values in UI:

From: 23/12/2022 8 am; To: 23/12/2022 10 pm

 

whenever, I click 'search' button, time range picker overrides the time modifiers earliest/latest values which are used in the Splunk query

Question:
could you please help me on overriding 'time range picker' values ( I need results between 15/01/2022 8 am to 15/01/2022 10 pm based on 'time modifiers' only)

Your answer would be greatly appreciated!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The times used for earliest and latest in your query should override the timepicker values. The job inspector should have a message saying this has happened

ITWhisperer_0-1660294329582.png

 

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...