Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Timepicker overriding inline time substitution

$
0
0

Hello,

When you specify an inline time sub using "earliest" and "latest", Splunk normally prefers this over the value in the timepicker drop down. It will also warn you that it is using the inline value with the following message:

Your timerange was substituted based on your search string

However, I'm running into the problem where this is no longer happening. I will try a very simple search like:

index=someindex earliest=-2d

And it will not perform the substitution (confirmed by the fact that it neither shows the above substitution warning nor does it return the expected data, which can be retrieved by choosing the same time with the picker).

Any idea why this is happening all of a sudden? Logs don't seem to have anything useful.


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>