https://community.splunk.com/t5/Splunk-Search/Searching-for-times-being-reached-within-the-hour/m-p/570212#M198740 <P>Check out the <FONT face="courier new,courier">relative_time</FONT> function in the Search Reference manual.</P> Fri, 08 Oct 2021 12:43:15 GMT richgalloway 2021-10-08T12:43:15Z https://community.splunk.com/t5/Splunk-Search/Searching-for-times-being-reached-within-the-hour/m-p/570176#M198729 <P><SPAN>Hi, I am new to Splunk and working with parking records. Within my events, I have a permit_expiry field, which is a date and time a few or so hours after the initial data timestamp.<BR /><BR />How do I display the number of permit_expiry which are occurring&nbsp;within the hour. I understand there is the now() function which holds the current time, but am unsure how to utilise it.</SPAN></P><P>My draft search is below, but I know there is something missing within the "now() + 1 hour".</P><P>sourcetype="parking_log"<BR />| where permit_expiry &lt; now() + 1 hour<BR />| stats count by permit_expiry<BR /><BR />Many thanks!</P> Fri, 08 Oct 2021 08:11:44 GMT https://community.splunk.com/t5/Splunk-Search/Searching-for-times-being-reached-within-the-hour/m-p/570176#M198729 mlg 2021-10-08T08:11:44Z https://community.splunk.com/t5/Splunk-Search/Searching-for-times-being-reached-within-the-hour/m-p/570212#M198740 <P>Check out the <FONT face="courier new,courier">relative_time</FONT> function in the Search Reference manual.</P> Fri, 08 Oct 2021 12:43:15 GMT https://community.splunk.com/t5/Splunk-Search/Searching-for-times-being-reached-within-the-hour/m-p/570212#M198740 richgalloway 2021-10-08T12:43:15Z