how to create new search term earliest and latest spesific time

[byapici]

Hello,

I was created new search term, but it not worked,

my example; sourcetype=xxxxx earliest=01/01/2017 12:00:00:000 latest=01/09/2017 12:00:00:000

[gcusello · Accepted solution]

Hi byapici
if you want to use a date in earliest and latest, put them into double quotes and use the following format: mm/dd/yyyy:HH:MM:SS
Bye.
Giuseppe

[byapici]

I was created new term sourcetype=xxxxx earliest="01/01/2017:12:00:00" latest="01/08/2017:12:00:00"

thakx 🙂

[martin_mueller]

It's easiest to use the time range picker to the right of the search bar, it has an entire section for specifying date and time for earliest and latest using calendar widgets and all that fancy stuff.
https://docs.splunk.com/Documentation/Splunk/6.6.2/Search/Selecttimerangestoapply#Define_custom_Date...

As for your inline approach, you're missing the colon between date and time.
https://docs.splunk.com/Documentation/Splunk/6.6.2/Search/Specifytimemodifiersinyoursearch