How to define time in earliest and latest?

[marisstella]

Hi All,
I want to fetch the results of this Monday, Last Monday, last to last Monday, the before Monday.
I tried this, earliest=-d@w1 latest=-d@w2, it is giving for this week but when I try similarly for alst week like earliest=-2d@w1 latest=-2d@w2 it didn't work...

Can anyone of you help me with this, please?

[ragedsparrow · Accepted solution]

Here is how I would do it:

• This Monday: earliest=@w1 latest=@w2
• Last Monday: earliest = -1w@w1 latest = -1w@w2
• etc..

(I wasn't sure what other time ranges you were trying to show, so I didn't include them)

Look at how the time modifiers work. The reason your first query was working was because of the offset of the snap-to-time of the @1w. The way you were working it was -1d@1w would do the same thing as -2d@1w

Here is the documentation for time modifiers, and specifically snap-to time units: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchTimeModifiers#Specify_a_sn...

[marisstella]

Thanks for your quick response. I tried increasing the numbers for more Previous week like earliest = -2w@w1 latest = -2w@w2, earliest = -3w@w1 latest = -3w@w2 It's working good.
Just trying to give the drop-down where end user can select Monday, Tuesday, Wed, Thu, Fri and trying to establish the connection between drop-down. also another drop-down like 10:00 AM, if the users select this, it should show up the values of 10AM to 11 AM of the current week, previous weeks...

Like ABC-service 05/11/2020 10:00:00 100 200 300

Any help onn this would be appreciated.. Thanks for your time.

[ragedsparrow]

Ah. This would be a little more challenging and would probably have to do with combining tokens or something like that. So, you would set the token for the day of the week and one for the hour range. Then you'd combine them and insert them into your search(es).

I don't have an example offhand that I can reference, but here is a previous answer that talks about combining tokens:

https://answers.splunk.com/answers/712353/can-you-help-me-combine-two-tokens-in-a-dashboard.html

[marisstella]

Thanks for your response