https://community.splunk.com/t5/Splunk-Search/Use-quot-Splunk-quot-relative-times-for-custom-fields/m-p/51761#M179610 <P>Thanks! That does it <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 07 Mar 2013 14:55:27 GMT JensT 2013-03-07T14:55:27Z https://community.splunk.com/t5/Splunk-Search/Use-quot-Splunk-quot-relative-times-for-custom-fields/m-p/51759#M179608 <P>Hi,</P> <P>i have records like this:</P> <P>2013-03-05 01:02:03.456Z foo=bar value=key start="2013-03-05 05:00:00.000Z" end="2013-03-05 07:00:00.000Z"</P> <P>Can i do search like "start &gt;=-1d@d+3h" ?</P> <P>Regards, </P> <P>Jens</P> Tue, 05 Mar 2013 15:57:56 GMT https://community.splunk.com/t5/Splunk-Search/Use-quot-Splunk-quot-relative-times-for-custom-fields/m-p/51759#M179608 JensT 2013-03-05T15:57:56Z https://community.splunk.com/t5/Splunk-Search/Use-quot-Splunk-quot-relative-times-for-custom-fields/m-p/51760#M179609 <P>Take a look at relative_time(time, modifiers): <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/CommonEvalFunctions</A></P> Thu, 07 Mar 2013 14:52:24 GMT https://community.splunk.com/t5/Splunk-Search/Use-quot-Splunk-quot-relative-times-for-custom-fields/m-p/51760#M179609 martin_mueller 2013-03-07T14:52:24Z https://community.splunk.com/t5/Splunk-Search/Use-quot-Splunk-quot-relative-times-for-custom-fields/m-p/51761#M179610 <P>Thanks! That does it <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 07 Mar 2013 14:55:27 GMT https://community.splunk.com/t5/Splunk-Search/Use-quot-Splunk-quot-relative-times-for-custom-fields/m-p/51761#M179610 JensT 2013-03-07T14:55:27Z