topic Re: does snap-to mean snap forward or snap back? in Splunk Search

does snap-to mean snap forward or snap back?

alexl1 — Thu, 14 Apr 2016 02:25:04 GMT

For example, if the time is 8:55 and I look for events -h@h, does that mean 7:00 (8:55-1=7:55, then to @h is 7) or 8:00? (8:55-1=7:55 but closest @h is 8:00)

thanks

Re: does snap-to mean snap forward or snap back?

alexl1 — Thu, 14 Apr 2016 02:25:58 GMT

also not sure the difference between -h@h and -1h@h

thanks

Re: does snap-to mean snap forward or snap back?

jkat54 — Thu, 14 Apr 2016 02:54:19 GMT

Hi,

-1h@h and -h@h are the exact same. They'll snap to the previous hour. Same logic applies for the rest of the possibilities such as -1d@d, etc.

To snap to the current hour, use @h instead.

Cheers,
JKat54

Re: does snap-to mean snap forward or snap back?

alexl1 — Thu, 14 Apr 2016 02:57:56 GMT

thanks -----

Re: does snap-to mean snap forward or snap back?

jkat54 — Thu, 14 Apr 2016 04:03:37 GMT

You're most welcome alexl1! Many thanks for accepting the answer!