|
on March 13th, -1mon maps to February 13th, at whatever the current time of day is. And -1mon@d maps to February 13th 12AM. In the dashboard we're dealing with, this is basically what we want. However it seems like on March 29th, 30th and 31st, ie in cases where that date didnt exist in the previous month it seems splunkd must do something a little arbitrary. So just to confirm, on all 3 of these days (3/29, 3/30, 3/31) does -1mon just map each to March 1st 12AM? |
|
According to: http://www.splunk.com/base/Documentation/latest/User/ChangeTheTimeRangeOfYourSearch#Syntax_for_relative_time_modifiers
If this applies, then you would expect it to snap March 29, 30, and 31 to February 28, 11:59:59 PM. In the leap year case, March 29 would map to February 29, at the same time of day. |
