https://community.splunk.com/t5/Splunk-Enterprise/time-modifiers/m-p/742182#M21890 <P>Here is the situation</P><P>Search web security appliance data (index=network sourcetype=cisco_wsa_squid) for non-business<BR />activity, i.e., usage values other than Business (usage!=Business) during the previous business week.</P><P>And here is query i got for it<BR />index=network sourcetype=cisco_wsa_squid (usage!=Business)<BR />earliest=-7d@w1 latest=@w6.</P><P>Could someone explain in latest why is it&nbsp;@w6 and not <A href="mailto:-7d@w6" target="_blank" rel="noopener">-7d@w6,&nbsp; @w6&nbsp;</A>&nbsp;will not include current week's data ?</P><P>#timemodiefiers</P> Wed, 19 Mar 2025 11:04:11 GMT Sukhmeet 2025-03-19T11:04:11Z https://community.splunk.com/t5/Splunk-Enterprise/time-modifiers/m-p/742182#M21890 <P>Here is the situation</P><P>Search web security appliance data (index=network sourcetype=cisco_wsa_squid) for non-business<BR />activity, i.e., usage values other than Business (usage!=Business) during the previous business week.</P><P>And here is query i got for it<BR />index=network sourcetype=cisco_wsa_squid (usage!=Business)<BR />earliest=-7d@w1 latest=@w6.</P><P>Could someone explain in latest why is it&nbsp;@w6 and not <A href="mailto:-7d@w6" target="_blank" rel="noopener">-7d@w6,&nbsp; @w6&nbsp;</A>&nbsp;will not include current week's data ?</P><P>#timemodiefiers</P> Wed, 19 Mar 2025 11:04:11 GMT https://community.splunk.com/t5/Splunk-Enterprise/time-modifiers/m-p/742182#M21890 Sukhmeet 2025-03-19T11:04:11Z https://community.splunk.com/t5/Splunk-Enterprise/time-modifiers/m-p/742183#M21891 <P>"@w6" aligns to the beginning of the previous Saturday (which is not in the current week!). Try "@w6+1w"</P> Wed, 19 Mar 2025 11:13:45 GMT https://community.splunk.com/t5/Splunk-Enterprise/time-modifiers/m-p/742183#M21891 ITWhisperer 2025-03-19T11:13:45Z