Timerangepicker: until yesterday 24:00

[HeinzWaescher]

Hi,

I would like to set the timerange picker that my search is always using data from date "X" until yesterday 24:00. How can I achieve this?

Best
Heinz

[martin_mueller · Accepted solution]

"Yesterday 24:00" is expressed as @d in Splunk relative time syntax. It's the same point in time as "Today 00:00", when used as the right bound of a search it's exclusive.

When using the verbose date-and-time configuration you select the "to" date as today 00:00, and the "from" date as your date X 00:00.

[HeinzWaescher]

Hi Martin,

sounds easy 🙂 Then I will use the advanced timerangepicker and set earliest:"unixtime" latest:@d.

Thanks a lot