Splunk Search

What time modifiers do I need to look at 1 hour of data for yesterday relative to today?

HattrickNZ
Motivator

I want to just look at 1 hour for yesterday, but I want it to be relative to today so no matter when I look at it in the future it will always be yesterday.

So if I look at it today it will show yesterdays value at 12pm to 1pm
And if I look at it next week it will show the day before that day at 12pm to 1pm

I am thinking of something like -1d@d for the earliest and @d for the latest but how do i get the hour I want?

0 Karma
1 Solution

grijhwani
Motivator

-1d@h to -23h@h

You can use any of the units for range as as your "snap to" boundaries.

View solution in original post

0 Karma

grijhwani
Motivator

-1d@h to -23h@h

You can use any of the units for range as as your "snap to" boundaries.

0 Karma

HattrickNZ
Motivator

will that work? will that not always be 23hours ago from your current hour. I want same hour for yesterday all the time.

0 Karma

grijhwani
Motivator

I just had another thought, it could also be specified as @d-12h to @d-11h.

0 Karma

grijhwani
Motivator

So what you are saying is that you will always want the hour 12:00..13:00 of the previous day.

OK, so that should be -d@d+12h to -d@d+13h.

You can add and subtract offsets after the snap.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...