https://community.splunk.com/t5/Splunk-Search/What-time-modifiers-do-I-need-to-look-at-1-hour-of-data-for/m-p/171665#M186445 <P>will that work? will that not always be 23hours ago from your current hour. I want same hour for yesterday all the time.</P> Sun, 16 Aug 2015 21:39:57 GMT HattrickNZ 2015-08-16T21:39:57Z https://community.splunk.com/t5/Splunk-Search/What-time-modifiers-do-I-need-to-look-at-1-hour-of-data-for/m-p/171663#M186443 <P>I want to just look at 1 hour for yesterday, but I want it to be relative to today so no matter when I look at it in the future it will always be yesterday. </P> <P>So if I look at it today it will show yesterdays value at 12pm to 1pm<BR /> And if I look at it next week it will show the day before that day at 12pm to 1pm</P> <P>I am thinking of something like <CODE>-1d@d</CODE> for the earliest and <CODE>@d</CODE> for the latest but how do i get the hour I want?</P> Sun, 16 Aug 2015 20:39:54 GMT https://community.splunk.com/t5/Splunk-Search/What-time-modifiers-do-I-need-to-look-at-1-hour-of-data-for/m-p/171663#M186443 HattrickNZ 2015-08-16T20:39:54Z https://community.splunk.com/t5/Splunk-Search/What-time-modifiers-do-I-need-to-look-at-1-hour-of-data-for/m-p/171664#M186444 <P><CODE>-1d@h</CODE> to <CODE>-23h@h</CODE></P> <P>You can use any of the units for range as as your "snap to" boundaries.</P> Sun, 16 Aug 2015 21:25:00 GMT https://community.splunk.com/t5/Splunk-Search/What-time-modifiers-do-I-need-to-look-at-1-hour-of-data-for/m-p/171664#M186444 grijhwani 2015-08-16T21:25:00Z https://community.splunk.com/t5/Splunk-Search/What-time-modifiers-do-I-need-to-look-at-1-hour-of-data-for/m-p/171665#M186445 <P>will that work? will that not always be 23hours ago from your current hour. I want same hour for yesterday all the time.</P> Sun, 16 Aug 2015 21:39:57 GMT https://community.splunk.com/t5/Splunk-Search/What-time-modifiers-do-I-need-to-look-at-1-hour-of-data-for/m-p/171665#M186445 HattrickNZ 2015-08-16T21:39:57Z https://community.splunk.com/t5/Splunk-Search/What-time-modifiers-do-I-need-to-look-at-1-hour-of-data-for/m-p/171666#M186446 <P>So what you are saying is that you will always want the hour 12:00..13:00 of the previous day.</P> <P>OK, so that should be <CODE>-d@d+12h</CODE> to <CODE>-d@d+13h</CODE>.</P> <P>You can add and subtract offsets after the snap.</P> Sun, 16 Aug 2015 21:44:32 GMT https://community.splunk.com/t5/Splunk-Search/What-time-modifiers-do-I-need-to-look-at-1-hour-of-data-for/m-p/171666#M186446 grijhwani 2015-08-16T21:44:32Z https://community.splunk.com/t5/Splunk-Search/What-time-modifiers-do-I-need-to-look-at-1-hour-of-data-for/m-p/171667#M186447 <P>I just had another thought, it could also be specified as @d-12h to @d-11h.</P> Sun, 06 Sep 2015 00:25:04 GMT https://community.splunk.com/t5/Splunk-Search/What-time-modifiers-do-I-need-to-look-at-1-hour-of-data-for/m-p/171667#M186447 grijhwani 2015-09-06T00:25:04Z