<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to get the earliest and latest for the last full hour in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-to-get-the-earliest-and-latest-for-the-last-full-hour/m-p/475115#M133553</link>
    <description>&lt;P&gt;In the SPL you can use &lt;CODE&gt;earliest=-1h@h latest=@h&lt;/CODE&gt; and you can use the &lt;CODE&gt;Advanced&lt;/CODE&gt; area of the &lt;CODE&gt;Time picker&lt;/CODE&gt; you can use the same values.&lt;/P&gt;</description>
    <pubDate>Mon, 04 Nov 2019 16:23:37 GMT</pubDate>
    <dc:creator>woodcock</dc:creator>
    <dc:date>2019-11-04T16:23:37Z</dc:date>
    <item>
      <title>How to get the earliest and latest for the last full hour</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-get-the-earliest-and-latest-for-the-last-full-hour/m-p/475114#M133552</link>
      <description>&lt;P&gt;Hello,&lt;/P&gt;

&lt;P&gt;How would I set the earliest and latest to the last full hour?&lt;BR /&gt;
Example:&lt;BR /&gt;
current time 5:19 pm&lt;BR /&gt;
I want earliest=4pm and latest=5pm&lt;/P&gt;

&lt;P&gt;Kind regards,&lt;BR /&gt;
Kamil&lt;/P&gt;</description>
      <pubDate>Mon, 04 Nov 2019 16:20:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-get-the-earliest-and-latest-for-the-last-full-hour/m-p/475114#M133552</guid>
      <dc:creator>damucka</dc:creator>
      <dc:date>2019-11-04T16:20:38Z</dc:date>
    </item>
    <item>
      <title>Re: How to get the earliest and latest for the last full hour</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-get-the-earliest-and-latest-for-the-last-full-hour/m-p/475115#M133553</link>
      <description>&lt;P&gt;In the SPL you can use &lt;CODE&gt;earliest=-1h@h latest=@h&lt;/CODE&gt; and you can use the &lt;CODE&gt;Advanced&lt;/CODE&gt; area of the &lt;CODE&gt;Time picker&lt;/CODE&gt; you can use the same values.&lt;/P&gt;</description>
      <pubDate>Mon, 04 Nov 2019 16:23:37 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-get-the-earliest-and-latest-for-the-last-full-hour/m-p/475115#M133553</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2019-11-04T16:23:37Z</dc:date>
    </item>
    <item>
      <title>Re: How to get the earliest and latest for the last full hour</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-get-the-earliest-and-latest-for-the-last-full-hour/m-p/475116#M133554</link>
      <description>&lt;P&gt;HI damucka&lt;BR /&gt;
try &lt;CODE&gt;earliest=-h@h latest=@h&lt;/CODE&gt;, anyway you can also use the time picker to find the correct time intervals.&lt;/P&gt;

&lt;P&gt;Ciao.&lt;BR /&gt;
Giuseppe&lt;/P&gt;</description>
      <pubDate>Mon, 04 Nov 2019 16:24:04 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-get-the-earliest-and-latest-for-the-last-full-hour/m-p/475116#M133554</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2019-11-04T16:24:04Z</dc:date>
    </item>
  </channel>
</rss>

