Archive
Highlighted

-45m@d what it means

Communicator

Hi @gcusello hope you are doing good,
As far as I understand, m@d means, beginning of the day, and -45m@d means, 45 minutes before the beginning of the day. Kindly correct me, I am always confused with this

Tags (1)
0 Karma
Highlighted

Re: -45m@d what it means

Legend

Hi @palisetty,
you can use the same time unit before and after @: in other words you cannot use -45m@d, but you can use -45m@m or -2h@h to have a time frame that starts from the beginning of the time unit you used.

If you want a time frame that starts 45 minutes before the beginning of the previous day, you should try -d@d-45m.
In other words, you can add a different time unit only after the same you used.
Sorry, I'm not sure to be clear but the example should explain better!

Anyway, you can easily test your time definitions opening the search dashboard and manually inserting your time modifiers in the advanced section of the Time picker: under the text box to insert the time modifier, the related time is displayed.
e.g.:
if you insert -d@d-45m you have 4/3/20 11:15:00.000 PM.
In this way, you can easily identify your time modifiers.

Ciao.
Giuseppe

0 Karma
Highlighted

Re: -45m@d what it means

Ultra Champion
| makeresults count=2 
| streamstats count 
| eval time_args=if(count=2,"-45m@d","@d-45m") 
| eval _time=relative_time(_time,time_args)
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.