Splunk Search

Search Time Range

dellytaniasetia
Explorer

Hi,

I have a simple question, what is the difference between earliest=-15m with earliest=-15m@s?

I could not find any diff when run my search. Any help is appreciated. Thanks

Tags (2)
0 Karma

acharlieh
Influencer

It is possible that you don't see a difference because you may not have any data that would be different. The relative time modifiers is discussed in the documents here: https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/SearchTimeModifiers#How_to_specif...

But for your specific question... Let's say you're running a search and it is right now to the sub-second exactly: 12:51:39.135

earliest=-15m would mean the earliest time for your time range is exactly 15 minutes ago, or 12:36:39.135

earliest=-15m@s means take the current time, subtract 15 minutes, and then round down to the nearest second, or in other words: 12:36:39.000

Unless you're dealing with high volumes of data that comes from devices that log down to subsecond precision it's unlikely that you would see differences between these two examples. But relative time modifiers locking down in general is a pretty handy thing to be familiar with.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...