How to use Time modifiers in mstats command?

[ssn]

I want to  use relative time modifiers (earliest/latest) in mstats command. Not sure how to use the time format.

| mstats earliest=-1h avg(xxx) WHERE index=xxx

This is failing since it is in relative time format. Documentation mentions about 'timeformat' attribute but I am not sure how to use it for relative time.

[ddvali]

Did you ever find a solution for this ? I also have same requirement.

[VatsalJagani]

You need to put earliest and latest as part of where condition.

| mstats latest(_value) AS val WHERE index="myindex" earliest=-1h@h latest=now BY host span=15m

Reference - https://docs.splunk.com/Documentation/Splunk/8.2.5/SearchReference/Mstats

[govardha]

The usage for this is as follows.  Hope this helps.

|mstats latest(_value) AS foo WHERE index="some_metrics_index" earliest=-300s latest=now() metric_name=some.metric BY host span=1m

[nbenson27]

Hello! 

Did you ever find a solution for this?