Thanks for the reply @livehybrid Job inspect was a great flag and shows the searches are not using the same time window. In ES7, “yesterday” appears to: earliestTime = 2026-04-20T00:00:00+01:00 latestTime = 2026-04-21T00:00:00+01:00 In ES8, “yesterday” shows as: earliestTime = 2026-04-20T01:00:00+01:00 latestTime = 2026-04-21T01:00:00+01:00 So ES8 seems to be using a midnight absolute range in UTC, which becomes 01:00–01:00 local time (BST). That explains why results from 00:53 today appear in ES8 but not ES7. The Splunk versions do differ too! ES8 = Splunk 10.2.0 ES7 = Splunk 9.2.7 I take it these are logic changes built into upgrades?
... View more