Hello,
When you specify an inline time sub using "earliest" and "latest", Splunk normally prefers this over the value in the timepicker drop down. It will also warn you that it is using the inline value with the following message:
Your timerange was substituted based on your search string
However, I'm running into the problem where this is no longer happening. I will try a very simple search like:
index=someindex earliest=-2d
And it will not perform the substitution (confirmed by the fact that it neither shows the above substitution warning nor does it return the expected data, which can be retrieved by choosing the same time with the picker).
Any idea why this is happening all of a sudden? Logs don't seem to have anything useful.