In a search text is it possible to "cut" the time range selected in the "time range picker"?
Exsample:
Selecting "Yesterday" in the time range picker can I cut my search of two hours to obtain events that occurred between 0:00:00 AM and 10:00:00 PM on yesterday?
Selecting "Last 30 days" in the time range picker can I cut my search of two days to obtain events that occurred 28 days ago?
Thank you.
a really simple way to define time would be to include earliest, latest or a combination of the two in your opening search statement.
E.g;
index=main earliest=-4d@d latest=-1d@d
would search back to between 4 days and 1 day ago.
EDIT:
Probably worth mentioning that you can define your own ranges for the time picker via times.conf too, have a look here;
http://docs.splunk.com/Documentation/Splunk/latest/admin/Timesconf