Time Modifier to an earlier day of the week

[luna]

Hi There,

I have a query that restricts events that were delivered and my search window is from 01/20/21 through 01/23/21. I am only seeing results for events that date from 1/21 through 1/22. This is because I have restricted the delivered events, so I am assuming no events were delivered on 1/20. However, lets say that within my query I would like to include the date for 1/20. My approach is adding  earliest=@w3 since 1/20 falls on a Wednesday.  Would like to know if my understanding of time modifiers is correct.

(index="YYY" earliest=@w3)
stats(records) as records by files
|where isnull(delivered)

[venkatasri]

Hi @luna 

There are multiple combinations of time modifiers in Splunk. Specify time modifiers in your search - Splunk Documentation helps to understand more,  docs says A time range that you specify in the Search bar earliest= latest= ( means the time between inclusive) , or in a saved search, overrides the time range that is selected in the Time Range Picker  in UI.

To satisfy your requirement refer absolute time window notes in above link, what you have tried was @w0 which is a relative timerange there is no harm using it its little tricky the time/date should be well calculated with snap.

--------------------------------------------------

An upvote would be appreciated if it helps!