All searches done in Splunk require a time range and this range is then matched against the _time field, so if you specify a time range window in the time picker of 3 years, ALL events in 3 years will be returned. In your example, you are first fetching data for 3 years, then parsing the JSON then searching for the WeekStarting field. This is totally unnecessary. You can also use the 'earliest=' and 'latest=' search parameters to control what events are returned, which override the time picker. This is simply a filter to the events returned by Splunk, in the same way that 'index=X' is a filter to only return events from index X. So, to use fixed _time ranges in the search parameter use the syntax described here https://docs.splunk.com/Documentation/Splunk/9.0.1/Search/Specifytimemodifiersinyoursearch#Specify_absolute_time_ranges to specify absolute time ranges. You can therefore combine multiple time ranges with () OR () OR () in your search. In that way, you will only return events for those time ranges you want, rather than all 3 years worth of data. Just try this is part of your original search index="AB" sourcetype="AB" (earliest="07/20/2020:00:00:00" latest="07/27/2020:00:00:00") and you will see it only returns events where _time is between those dates.
... View more
