Dashboards & Visualizations
Highlighted

Time Range question

Communicator

I am new to Splunk, what is meant by "-1d@d+12h" in the time-range? Please explain

Tags (1)
0 Karma
Highlighted

Re: Time Range question

Champion

Hi

It represents yesterday at 12 pm. -1d@d - today -1(yesterday) @d+12h - 12 pm

View solution in original post

0 Karma
Highlighted

Re: Time Range question

Communicator

Thank You. You mean, 1d@d = today.
-1d@d=yesterday?

0 Karma
Highlighted

Re: Time Range question

Champion

@d today, -1d@d=yesterday

0 Karma
Highlighted

Re: Time Range question

Communicator

1d@d means? Please don't mind about asking silly questions. I am trying to make sure I get it.

0 Karma
Highlighted

Re: Time Range question

Champion

1d@d - Invalid. If you prefix + +1d@d represents next day

0 Karma
Highlighted

Re: Time Range question

Communicator

Perfect. Thank You

0 Karma
Highlighted

Re: Time Range question

SplunkTrust
SplunkTrust

The Search Reference manual explains time modifiers. See https://docs.splunk.com/Documentation/Splunk/7.3.3/SearchReference/SearchTimeModifiers. In this example, the time range starts at noon yesterday (one day ago at 0:00 ("-1d@d") plus twelve hours ("+12h")).

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Time Range question

Communicator

Ravi -24h@h means?
@h is the current hour.
-24h means 24 hours of yesterday? I so, when is the start time?
Please correct me.

0 Karma
Highlighted

Re: Time Range question

Champion

current time(hour) - 24 hours

0 Karma