Hi mgardler, using your search string like this splunk search "@aol earliest=02/01/2011:00:00:00 latest=03/01/2011:00:00:00 -maxout=0" works without problem. The result looks like this: splunk search "@aol earliest=02/01/2011:00:00:00 latest=03/01/2011:00:00:00 -maxout=0" INFO: Your timerange was substituted based on your search string as prove take this run everywhere command splunk search "index=_internal * earliest=10/29/2014:00:00:00 latest=10/31/2014:00:00:00 | stats count " INFO: Your timerange was substituted based on your search string count ----- 84357 hope this helps ... cheers, MuS ... View more