Splunk Dev

Why is relative time is search not working?

jip31
Motivator

hi

 

I use this relative time in my search

 

earliest=@d+7h latest=@d+19h 

 

 now I want the same slot time but one day ago (it means between 7h and 19h)

so i am doing this but it doenst works

 

earliest=-1d+7h latest=-1d+19h 

 

what is wrong please?

Labels (1)
Tags (1)
0 Karma

johnhuang
Motivator

Keep in mind that =@d is a short way of expressing =-0d@d. As best practice, I recommend you use =-0d@d. 

 

earliest=-1d@d+7h latest=-1d@d+19h

 

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...