How to get the last hour of events but also remove any data after last hour

[michael_wong]

Deleted

[bowesmana]

You can control the time window of your search, e.g. if you set the earliest to be -4h@h and the latest to be @h , e.g.

earliest=-4h@h latest=@h

then you will get the previous 4 hours up to the last completed hour

[michael_wong]

Thanks for your help. But I need to use it in tstats command, and it will give error "'tstats' command: Invalid argument: 'earliest=-4h@h'"  Do you know any other way. Better it can use in time picker as well.

[bowesmana · Accepted solution]

Set the time picker to Advanced and set the earliest/latest as needed -4h@h and @h