You can refer to following site. http://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps Splunk uses the following precedence to assign timestamps to events: Look for a time or date in the event itself using an explicit TIME_FORMAT if provided. Use positional timestamp extraction for events that have more than one timestamp value in the raw data. If no TIME_FORMAT is provided, or no match is found, attempt to automatically identify a time or date in the event itself. Use positional timestamp extraction for events that have more than one timestamp value in the raw data. If an event doesn't have a time or date, use the timestamp from the most recent previous event of the same source. If no events in a source have a date, look in the source (or file) name (Must have time in the event). For file sources, if no time or date can be identified in the file name, use the modification time on the file. If no other timestamp is found, set the timestamp to the current system time (at the event's index time). For file sources, if no time or date can be identified in the file name, use the modification time on the file. If no other timestamp is found, set the timestamp to the current system time (at the event's index time). ... View more

In particular, unless you share them, the saved search results will have the same ACL as the original search object they were generated from. ... View more

Simpler: sourcetype=mystuff [ search sourcetype=mystuff "interesting event" | eval earliest=_time-5 | eval latest=_time+5 | return earliest latest] ... View more