Splunk Search

How to get the earliest and latest for the last full hour

damucka
Builder

Hello,

How would I set the earliest and latest to the last full hour?
Example:
current time 5:19 pm
I want earliest=4pm and latest=5pm

Kind regards,
Kamil

1 Solution

woodcock
Esteemed Legend

In the SPL you can use earliest=-1h@h latest=@h and you can use the Advanced area of the Time picker you can use the same values.

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI damucka
try earliest=-h@h latest=@h, anyway you can also use the time picker to find the correct time intervals.

Ciao.
Giuseppe

0 Karma

woodcock
Esteemed Legend

In the SPL you can use earliest=-1h@h latest=@h and you can use the Advanced area of the Time picker you can use the same values.

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...