Splunk Search

How to get the earliest and latest for the last full hour

damucka
Builder

Hello,

How would I set the earliest and latest to the last full hour?
Example:
current time 5:19 pm
I want earliest=4pm and latest=5pm

Kind regards,
Kamil

1 Solution

woodcock
Esteemed Legend

In the SPL you can use earliest=-1h@h latest=@h and you can use the Advanced area of the Time picker you can use the same values.

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI damucka
try earliest=-h@h latest=@h, anyway you can also use the time picker to find the correct time intervals.

Ciao.
Giuseppe

0 Karma

woodcock
Esteemed Legend

In the SPL you can use earliest=-1h@h latest=@h and you can use the Advanced area of the Time picker you can use the same values.

0 Karma
Get Updates on the Splunk Community!

Customer Experience | Splunk 2024: New Onboarding Resources

In 2023, we were routinely reminded that the digital world is ever-evolving and susceptible to new ...

Celebrate CX Day with Splunk: Take our interactive quiz, join our LinkedIn Live ...

Today and every day, Splunk celebrates the importance of customer experience throughout our product, ...

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...