That was actually the first thing I tried (setting earliest=0). It gives the same set of events as the time selector and earliestTime in the job details is the midnight this morning when "Today" is selected, even though my test data goes back about a year. ... View more

Sorry, I'm not trying to say it's a bad regex, that's exactly my problem. It's not what I would have used, but it should work with the example data he has, which makes it rather difficult to produce a regular expression that works on the data that's failing, but isn't provided. ... View more

Are you saying that regular expression is sending the one with "warning" to the null queue or not sending the other one? I would have written a match to send '^[[^]]+]\s+-\s+warning' to a real queue instead of using a negative lookahead assertion, and then everything else to the nullQueue, but the regex you have should work on those example lines. ... View more

An alert specifies the timerange to search as part of the alert. This isn't really different than a search command with the time picker on the right (except the time picker is picked by the alert). You should be able to override that with "earliest" so tag = authentication earliest=-20y | transaction host user | where _time > (now() - 3600) (technically that only searches the last 20 years, but that's probably sufficient. "earliest" does allow absolute times, but I don't think you can specify the earliest event (which is what dispatch will use if you select "All Time" on the selector) from the command line). But I wouldn't do that. There's a limit to the number of transactions Splunk will track and the number of events in a transaction, and it has to keep track of the entire transaction in memory, so if anybody has more than 1000 logins it's going to lose track of it. You're probably better off with tag = authentication earliest=-20y | stats first(_time) as firsttime by host,user | where firsttime > (now()-3600) ... View more