Is it possible to specify earliest= at subsecond granularity?
Thanks for your help.
Yes.
[splunk@MrT ~]$ splunk/bin/splunk search 'index=_internal earliest=1299878273 latest=1299878274 | stats count'
INFO: Your timerange was substituted based on your search string
count
-----
46
[splunk@MrT ~]$ splunk/bin/splunk search 'index=_internal earliest=1299878273.651 latest=1299878274 | stats count'
INFO: Your timerange was substituted based on your search string
count
-----
4
Yes.
[splunk@MrT ~]$ splunk/bin/splunk search 'index=_internal earliest=1299878273 latest=1299878274 | stats count'
INFO: Your timerange was substituted based on your search string
count
-----
46
[splunk@MrT ~]$ splunk/bin/splunk search 'index=_internal earliest=1299878273.651 latest=1299878274 | stats count'
INFO: Your timerange was substituted based on your search string
count
-----
4
Awesome! Thanks!