The root cause of the problem here, as pointed out, is the _time is a calculated field. When the search process expands the search it notices that _time can be changed/set at search time by the calculated field and it expands the search to (assuming earliest=1234567890):
... (_time>1234567890 OR sourcetype=england ) ....
Which means that the search now doesn't have a set earliest time (notice the OR) and thus the observed problem.
In Hunk, calculated _time is needed because, for structured data (csv, avro ...), the required field optimization eliminates 'Date' when someone doesn't reference it in the search - ie runs a search like this: "index=vix | stats count by foo". Adding a calculated field helps with mapping _time to Date however it breaks partition pruning because it expands searches to all time.
We are planning to introduce a fix for this in Hunk 6.2
... View more
