Splunk Search

Setting up earliest and latest time with relative date and fixed time

AruBhende
Explorer

I am trying to define a query where I have to use the earliest time as 2 days ago at 22:20:45 and latest time 1 day ago at 22:20:45

I tried different formats below

earliest=-2d@:22h:20m:45s

latest=-1d@d+20h+30m+45s

But - I am not sure if these are correct and also how can I check if this translates to the date and time I am trying to set.

Thank you

 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I've used similar formats before - only with a single add-on (-1@d+8h, for example) - but I think it should work.

Fix the earliest to -2d@d+22h+20m+45s 

To verify you're getting the right start and end times, add the addinfo command to your query and display the info_min_time and info_max_time fields.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I've used similar formats before - only with a single add-on (-1@d+8h, for example) - but I think it should work.

Fix the earliest to -2d@d+22h+20m+45s 

To verify you're getting the right start and end times, add the addinfo command to your query and display the info_min_time and info_max_time fields.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Smartness with Brandon Sternfield | Episode 3

Hello and welcome to another episode of "Splunk Smartness," the interview series where we explore the power of ...

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...