topic Re: between earliest=beginning of the previous day (00:00:00) latest=end of previous day (23:59:59) in Splunk Search

between earliest=beginning of the previous day (00:00:00) latest=end of previous day (23:59:59)

jclemons7 — Fri, 12 Feb 2016 17:47:06 GMT

I need a way to programatically calculate the beginning of the previous day and the end of he previous day.

Any help is greatly appreciated.

Re: between earliest=beginning of the previous day (00:00:00) latest=end of previous day (23:59:59)

somesoni2 — Fri, 12 Feb 2016 17:52:35 GMT

How about using the relative time (hoping the programmatically in splunk search is asked here)

your base search earliest=-1d@d latest=@d

Re: between earliest=beginning of the previous day (00:00:00) latest=end of previous day (23:59:59)

jclemons7 — Fri, 12 Feb 2016 18:00:12 GMT

does that actually put it at 00:00:00 to 23:59:59 for instance?.. it's not relative to the time I run the query?

Re: between earliest=beginning of the previous day (00:00:00) latest=end of previous day (23:59:59)

somesoni2 — Fri, 12 Feb 2016 18:08:31 GMT

It will put (if I run it today Feb 12 ) earliest=02/11/2016 00:00:00 to latest=02/12/2016 00:00:00.

It relative to the time you runt he query. You can check/test this option from the Splunk's search page itself. In time range picker dropdown, the last section is advanced, there you can test relative time values and can see actual resolved date just below the text boxes.