What is the chained relative time range command for a search from two months ago?

[neilsussman]

Hi,

I'm scheduling a search from December 1 - January 1 but cannot find the right time range. I tried Start Time -2mon@1mon and Finish Time @1mon but that didn't work. Can someone please let me know how to schedule a search for a specified month range?

Thanks!

[lguinn2]

Try this

earliest=-2mon@mon latest=-1mon@mon

Also, when you are building the search, click the Time Range picker and choose "Custom Time". In the Custom Time popup, you can pick an absolute time range. But you can also choose "Relative Time." The cool thing about the relative time selection is that it will show you the actual time equivalent. It's an easy way to confirm that -2mon@mon is actually December 1, for example.

[neilsussman]

That worked perfectly! Thanks!