Splunk Search

Time Modifier to an earlier day of the week

luna
Explorer

Hi There,

I have a query that restricts events that were delivered and my search window is from 01/20/21 through 01/23/21. I am only seeing results for events that date from 1/21 through 1/22. This is because I have restricted the delivered events, so I am assuming no events were delivered on 1/20. However, lets say that within my query I would like to include the date for 1/20. My approach is adding  earliest=@w3 since 1/20 falls on a Wednesday.  Would like to know if my understanding of time modifiers is correct.

(index="YYY" earliest=@w3)
stats(records) as records by files
|where isnull(delivered)

 

Labels (3)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @luna 

There are multiple combinations of time modifiers in Splunk. Specify time modifiers in your search - Splunk Documentation helps to understand more,  docs says A time range that you specify in the Search bar earliest= latest= ( means the time between inclusive) , or in a saved search, overrides the time range that is selected in the Time Range Picker  in UI.

To satisfy your requirement refer absolute time window notes in above link, what you have tried was @w0 which is a relative timerange there is no harm using it its little tricky the time/date should be well calculated with snap.

--------------------------------------------------

An upvote would be appreciated if it helps!

Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...