Hi,
I have the following simple search.
sourcetype=ib:reserved1 source=ib:user:user_login index=ib_security earliest=-1w
When i run this search i do not get results. But when i remove the earliest command, I get the results.
All the results have todays date as time. So it should return result when I put earliest as 1 week back.
Why is earliest not working
Thanks
↧