topic Re: Relative Time search (e.g. today 4AM) in Splunk Search

Relative Time search (e.g. today 4AM)

nicolas_pons — Fri, 21 Apr 2017 13:46:12 GMT

Hi,

I have a report (scheduled to be run every 5 minutes) that I have built, it list the number of specific events over time, displayed using a column chart.
However, i know that there won't be events between midnight and 4AM, how can i have a yet relative earliest time (today) but a fix starting time of 4AM ?

I have spent quite some time looking for this and am rather stuck atm.

Many thanks for your support.

Re: Relative Time search (e.g. today 4AM)

richgalloway — Fri, 21 Apr 2017 14:19:14 GMT

Try earliest=@d+4h

Re: Relative Time search (e.g. today 4AM)

nicolas_pons — Fri, 21 Apr 2017 14:29:05 GMT

Awesome ! It works ! Thanks for your fast answer.

Re: Relative Time search (e.g. today 4AM)

puneethgowda — Fri, 21 Apr 2017 14:48:10 GMT

base search date_hour > 3 | stats.....