https://community.splunk.com/t5/Splunk-Search/Start-time-search-in-splunk/m-p/93266#M182408 <P>How can I have a start time on my search, so that it starts every time reflecting the current time. I want to display a line chart/graph showing the beginning of my search as it progresses over time. My command so far is this......</P> <P>source="/var/log/scenario1.log" | timechart span=5s max(host_bandwidth) by host </P> Mon, 02 May 2011 16:14:52 GMT Nixon1023 2011-05-02T16:14:52Z https://community.splunk.com/t5/Splunk-Search/Start-time-search-in-splunk/m-p/93266#M182408 <P>How can I have a start time on my search, so that it starts every time reflecting the current time. I want to display a line chart/graph showing the beginning of my search as it progresses over time. My command so far is this......</P> <P>source="/var/log/scenario1.log" | timechart span=5s max(host_bandwidth) by host </P> Mon, 02 May 2011 16:14:52 GMT https://community.splunk.com/t5/Splunk-Search/Start-time-search-in-splunk/m-p/93266#M182408 Nixon1023 2011-05-02T16:14:52Z https://community.splunk.com/t5/Splunk-Search/Start-time-search-in-splunk/m-p/93267#M182409 <P>per <A href="http://www.splunk.com/base/Documentation/latest/User/RealtimeSearch">http://www.splunk.com/base/Documentation/latest/User/RealtimeSearch</A><BR /> under the section 'Specify real-time time range windows':</P> <P>The syntax for real-time time modifers is: </P> <PRE><CODE>rt[+|-]&lt;time_integer&gt;&lt;time_unit&gt;@&lt;time_unit&gt; </CODE></PRE> <P>You can find more information about the syntax for time modifiers in the topic, Change the time range of your search. </P> <P><A href="http://www.splunk.com/base/Documentation/4.2.1/User/ChangeTheTimeRangeOfYourSearch">http://www.splunk.com/base/Documentation/4.2.1/User/ChangeTheTimeRangeOfYourSearch</A></P> Mon, 02 May 2011 16:30:50 GMT https://community.splunk.com/t5/Splunk-Search/Start-time-search-in-splunk/m-p/93267#M182409 Chubbybunny 2011-05-02T16:30:50Z