000034782 - Search getting results with an Event Time that is outside the time range specified in RSA NetWitness

Document created by RSA Customer Support Employee on Feb 7, 2017Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000034782
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: SA Security Analytics UI
RSA Version/Condition:
IssueWhen trying to run custom investigation using specific time frame, we are always seeing data beyond this time frame as seconds aren't counted; it only took the hours and minutes into consideration.
Resolution- The product is working as designed.
"If you specify custom start or end times in seconds, the value for start time in seconds will always default to :00, and the value for end time in seconds will always default to :59. For example, if you are using time to drill down into an issue, the drill time will be interpreted as "HH:MM:00 - HH:MM:59." Seconds display in this format in Investigation > Navigate functions."