Time Picker Override: How Search Strings Take Precedence

Quick Answer

Splunk evaluates time constraints from more than one place at once, the graphical time picker and any time modifiers typed directly into the search string, and when both are present, the modifier written into the SPL itself always takes precedence over whatever is selected in the picker. In this scenario, selecting 'Last 24 hours' sets the picker's range, but if the search string also contains an explicit constraint like earliest=-1h, that inline modifier overrides the picker and narrows the actual search window down to just the last hour, which is exactly why the results only reflect that shorter span even though the picker visually shows a much longer one. This is a common source of confusion because the time picker looks like the single source of truth for a search's time range, but it's really only the default that applies when the search itself doesn't specify otherwise. Any time a question describes a mismatch between the time range a user selected in the picker and the actual span of returned results, especially when the results reflect a shorter or more specific window, the explanation almost always traces back to an earliest or latest modifier embedded directly in the search string. The lesson to carry forward is to always check the raw SPL for explicit time modifiers before assuming the picker's setting is what actually controlled the search.