Splunk Search

Using Time Modifiers in search for timechart

jason_hotchkiss
Communicator

Hello - 

I was reading this:  https://docs.splunk.com/Documentation/SCS/current/Search/Timemodifiers

But it is not very clear to me how to use the time modifiers properly.

index=blah sourcetype=blah
fields _time index sourcetype GB
| timechart span=1d sum(GB) as Gigabytes

How would I draw my time chart to the end of the previous day over a 7-day period using a time modifier?

Would it be:  

index=blah sourcetype=blah _index_earliest=-7d@d index_latest=-1d@d

Please advise, thank you.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

@d takes you to the beginning of the day so for end of previous day you need latest=@d i.e. beginning of current day.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

@d takes you to the beginning of the day so for end of previous day you need latest=@d i.e. beginning of current day.

jason_hotchkiss
Communicator

Ahh... I tried -@d - didn't occur to me to try @d.  Thank you.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...