Splunk Search

earliest=0 is not overriding the time range selected in dropdown menu

cwl
Contributor

When I did a search like "index=_internal earliest=0" + "Last 15 minutes" in drop down menu I could not see below message that I usually see when time range is overridden. I was expecting to see result from all times but I could see only last 15 minutes of search result.

Your timerange was substituted based on your search string 

Tags (2)
0 Karma
1 Solution

cwl
Contributor

"earliest=0" is a special case in the search language and should not be used.
Please replace all instances of "earliest=0" with "earliest=1" in search syntax.

View solution in original post

cwl
Contributor

"earliest=0" is a special case in the search language and should not be used.
Please replace all instances of "earliest=0" with "earliest=1" in search syntax.

pramit46
Contributor

when do you use 0?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...