Hi All, on my splunk 7.0.3, faced this multiple times.
on a report, i select Edit--> Edit Schedule-- then choose, third option "Advanced".
for Earliest and Latest, below the input box, it gives example times (1/8/19 5:40:27.000 AM and 1/8/19 5:55:27.000 AM) (it takes the current time for latest and 15mins before for earliest). but when i enter this time in the input box, it says "Invalid time".
the earliest and latest times which works fine on the Splunk GUI search query, also fail here at the reports schedule.
may i know if you guys also faced this issue, thanks.
Hi @inventsekar
Try by specifying in Unix time format(epoch)/relative and it will automatically convert to local time.
Looks like a bug. Splunk should've converted the string formatted time to epoch time
Advanced should accept relative time only. Absolute times should not populate here as time formats can be different (i.e. 19 vs 2019). Only exception to the absolute times is if its in epoch format
thanks @skoelpin .. it looks like a bug only, thought to verify with few others here, so that i/we can raise a bug report / feature request to Splunk.