Splunk Search

-45m@d what it means

palisetty
Communicator

Hi @gcusello hope you are doing good,
As far as I understand, m@d means, beginning of the day, and -45m@d means, 45 minutes before the beginning of the day. Kindly correct me, I am always confused with this

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @palisetty,
you can use the same time unit before and after @: in other words you cannot use -45m@d, but you can use -45m@m or -2h@h to have a time frame that starts from the beginning of the time unit you used.

If you want a time frame that starts 45 minutes before the beginning of the previous day, you should try -d@d-45m.
In other words, you can add a different time unit only after the same you used.
Sorry, I'm not sure to be clear but the example should explain better!

Anyway, you can easily test your time definitions opening the search dashboard and manually inserting your time modifiers in the advanced section of the Time picker: under the text box to insert the time modifier, the related time is displayed.
e.g.:
if you insert -d@d-45m you have 4/3/20 11:15:00.000 PM.
In this way, you can easily identify your time modifiers.

Ciao.
Giuseppe

0 Karma

to4kawa
Ultra Champion
| makeresults count=2 
| streamstats count 
| eval time_args=if(count=2,"-45m@d","@d-45m") 
| eval _time=relative_time(_time,time_args)
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...