SPLK-1001 · Question #208
You can also specify a time range in the search bar. You can use the following for beginning and ending for a time range (Choose two.):
The correct answer is D. earliest= E. latest=. In Splunk's Search Processing Language (SPL), earliest= and latest= are the correct keywords for specifying the beginning and end of a time range directly in the search bar (e.g., earliest=-24h latest=now). Option A is wrong because Splunk absolutely supports manual time…
Question
You can also specify a time range in the search bar. You can use the following for beginning and ending for a time range (Choose two.):
Options
- ANot possible to specify time manually in Search query
- Bend=
- Cstart=
- Dearliest=
- Elatest=
How the community answered
(35 responses)- A9% (3)
- B3% (1)
- C6% (2)
- D83% (29)
Explanation
In Splunk's Search Processing Language (SPL), earliest= and latest= are the correct keywords for specifying the beginning and end of a time range directly in the search bar (e.g., earliest=-24h latest=now). Option A is wrong because Splunk absolutely supports manual time specification in search queries. Options B and C (end= and start=) are incorrect because these are not valid Splunk SPL time modifiers - they come from other query languages and do not work in Splunk. A helpful memory tip: think "E for Extremes" - earliest marks the extreme beginning of your time window, and latest marks the extreme end, and both start with E, just like the correct answer choices (D and E).
Community Discussion
No community discussion yet for this question.