Our Splunk instance has recently (yesterday?) been updated to 7.1.0 from 7.0.0.
My queries were working perfectly before but now the map
function returns the following error:
Invalid value "$TimeEarliest" for time term 'earliest'
The value is in the correct format as specified here. (i.e. %m/%d/%Y:%H:%M:%S
) When I copy the actual values from the table (before I apply the map function) and put them in place of the $TimeEarliest$
and $TimeLatest$
it works perfectly.
Hence, I think something is wrong with parsing a time variable to/in the map
function.
The search is as follows:
search sourcetype IN (list of sourcetypes) $Id1$ OR $Id2$ earliest=$TimeEarliest$ latest=$TimeLatest$
I have confirmed/double checked that all 4 variables are set and are in the correct format (in case of the time variables).
I also cannot find anything about this issue here nor here. (known issues and "Update to 7.1.0 read this first"). Nor anywhere on Splunk Answers either.
Anyone knows what's going wrong?
If anyone has this problem, the following solved it for me:
Instead of using "earliest" and "latest" in the search I now simply use:
_time>= "$TimeEarliest$" OR _time<="$TimeLatest$"
This seems to have fixed the issue. I am not sure whether it affects the performance of the query, but since it is already a large/slow query it doesn't really matter for me.
If anyone has this problem, the following solved it for me:
Instead of using "earliest" and "latest" in the search I now simply use:
_time>= "$TimeEarliest$" OR _time<="$TimeLatest$"
This seems to have fixed the issue. I am not sure whether it affects the performance of the query, but since it is already a large/slow query it doesn't really matter for me.
Interesting. Haven't heard this.
1) Check the job inspector and see what was input into the search itself.
2) try putting properly-escaped quotes around the TimeEarliest and TImeLatest variables.
("Properly escaped" is going to depend whether you are in a dash, a saved search, etc.)
Hi @DalJeanis thanks for you reply!
I've found a workaround: using _time>= "$TimeEarliest$" OR _time<="$TimeLatest$"
Bump?......
Help please 😞