Reporting

What is the chained relative time range command for a search from two months ago?

Explorer

Hi,

I'm scheduling a search from December 1 - January 1 but cannot find the right time range. I tried Start Time -2mon@1mon and Finish Time @1mon but that didn't work. Can someone please let me know how to schedule a search for a specified month range?

Thanks!

0 Karma

Legend

Try this

earliest=-2mon@mon latest=-1mon@mon

Also, when you are building the search, click the Time Range picker and choose "Custom Time". In the Custom Time popup, you can pick an absolute time range. But you can also choose "Relative Time." The cool thing about the relative time selection is that it will show you the actual time equivalent. It's an easy way to confirm that -2mon@mon is actually December 1, for example.

Explorer

That worked perfectly! Thanks!

0 Karma