Dashboards & Visualizations

9:37 30m@d

palisetty
Communicator

@gcusello

9:37 -30m@h
Sorry for asking this again. As far as I understand, I will tell you kindly correct me.
@h is current hour, which goes to 9. -30m which is 30 minutes before current hour, so it will be 8:30 - 8:59.


9:37 -30m@d
@d is current day at 0:00 hours. so -30m would be yesterday 23:30 to 23:59.

Tags (1)
0 Karma

pramit46
Contributor

If you run the following search at 09:37 AM:
index=_internal earliest=-1h@h lastest=now, then earliest time will be: 08:00 AM and latest time will be: 09:37 AM

If you run the following search at 09:37 AM:
index=_internal earliest=-1h lastest=now, then earliest time will be: 08:37 AM and latest time will be: 09:37 AM

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...