Splunk Search
Highlighted

How do I set a timerange to be the last full 7 days?

Path Finder

I have a script that populates the previous day's data early in the following morning. How do I set a time range such that I get results from the past 7 full days? Setting "earliest=-7d" still relies on the current time. So if today is Tuesday the 30th, I want to search from midnight last Tuesday to midnight on the 29th.

Tags (1)
Highlighted

Re: How do I set a timerange to be the last full 7 days?

Builder

Try earliest=-7d@d (snap to the beginning of the day).

View solution in original post

Highlighted

Re: How do I set a timerange to be the last full 7 days?

Legend

You would need to use earliest=-7d@d, but you also need latest=@d to set the end time correctly to the 00:00 today/24:00 yesterday. (I assume that's what you mean by "midnight"; if you meant 00:00 yesterday, then you need latest=-1d@d instead.)

View solution in original post

Highlighted

Re: How do I set a timerange to be the last full 7 days?

Contributor
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.