Splunk Search

Why is Splunk not throwing an error when the time range I selected for my search is between a past and a future date?

m_vivek
Path Finder

I have a basic search like this:

 index=pqr host=xyz* NOT TYPE="*ABCDE*" | fields X, Y |timechart limit=0 span=10m count, avg(X) by Y

And I search it using the date range. Today, I tried choosing a date in the past and another one into the future . I expected to be thrown an error, but the search ran without errors. Why? Today is the 3rd. The date I chose was the 4th.

alt text

0 Karma
1 Solution

jeffland
SplunkTrust
SplunkTrust

Why would you expect an error? The time range you search on (and more importantly, it's relation to the current time) is arbitrary. Splunk will search on data from time X to time Y, regardless of the current time.

You will get an error however when you try to index data that is either too old or too far in the future. Generally, it is perfectly legal to index data with a future timestamp (in standard configuration, this means two days ahead). These settings are configured in props.conf with MAX_DAYS_AGO and MAX_DAYS_HENCE.

View solution in original post

woodcock
Esteemed Legend

Because data is sometimes mis-timestamped, it is necessary to search for "impossible" things such as events that "have not yet happened". The capability to search into the future is a huge benefit when trying to track down things like wrong TZ being applied to timestamps.

jeffland
SplunkTrust
SplunkTrust

Why would you expect an error? The time range you search on (and more importantly, it's relation to the current time) is arbitrary. Splunk will search on data from time X to time Y, regardless of the current time.

You will get an error however when you try to index data that is either too old or too far in the future. Generally, it is perfectly legal to index data with a future timestamp (in standard configuration, this means two days ahead). These settings are configured in props.conf with MAX_DAYS_AGO and MAX_DAYS_HENCE.

m_vivek
Path Finder

Ok. Thanks. I think I now have a better understanding. I was expecting an error because, there was no data present for the future date, and I thought I would get something like 'out of range chosen or invalid dates chosen.'

0 Karma

jeffland
SplunkTrust
SplunkTrust

Why should you get an error when you search in a timerange that has no data? You'll simply get zero results. It's not "illegal" or somehow "undefined" what happens in that case.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...