Splunk Search

Why is the timerange in my CLI search not working properly in Splunk 5.0.6?

mgardler
New Member

There are lots of questions in here, but none work correctly:

Search:
splunk search "@aol" earliest=02/01/2011:00:00:00 latest=03/01/2011:00:00:00 -maxout=0

No matter what dates I put in here, the same results return
Also tried: ealiest_time, latest_time: index_earliest, index_latest

Everything returns the same information.....

What is a valid search string for a time range? (Running Splunk 5.0.6 (build 185560))

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi mgardler,

using your search string like this

splunk search "@aol earliest=02/01/2011:00:00:00 latest=03/01/2011:00:00:00 -maxout=0"

works without problem. The result looks like this:

splunk search "@aol earliest=02/01/2011:00:00:00 latest=03/01/2011:00:00:00 -maxout=0"
INFO: Your timerange was substituted based on your search string

as prove take this run everywhere command

splunk search "index=_internal * earliest=10/29/2014:00:00:00 latest=10/31/2014:00:00:00  | stats count "
INFO: Your timerange was substituted based on your search string
count
-----
84357

hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...