Answer by warren for Use sub-second precision on “earliest” in Splunk query

Yes, earliest‘s precision is limited to "standard" Unix epoch time (ie the number of elapsed seconds since the dawn of Unix (arbitrarily set to 01 Jan 1970 00:00:01 (or, sometimes, 31 Dec 1969 23:59:59))) because the _time field holds whole-number seconds.

Splunk knows how to convert timestamps seen with more precision than mere seconds, but that does not mean _time natively holds them.

_time, and, therefore, anything that references it (like earliest) does not understand subsecond precision. For that, you will need to have another field that contains it in your event.

from User warren – Stack Overflow https://stackoverflow.com/questions/64232440/use-sub-second-precision-on-earliest-in-splunk-query/64936207#64936207
via IFTTT