Just build on that..
earliest=-1d@d latest=@d earliest=-2d@d latest=-1d@d earliest=-3d@d latest=-2d@d ...
How can i do similarly for certain time range?
I want to run my query for every 5minutes and 15 minutes (i have 2 diff queries).
how can i get results for past 5 minutes and how can i get results for past 15 minutes using "earliest= latest=" parameters.
Hey @chow11, since this is an older post you might want to create a new question. Here's some info on how to ask a question http://docs.splunk.com/Documentation/Splunkbase/splunkbase/Answers/Questions