Why does using a time modifier in a search give a different output than selecting the time from the GUI?

[lohit]

Hi All ,

I have running a search to grab events for the last 1 hour. so in my search i am using earliest=-1h@h. It says in the following format:
n events (before current date/time)

However, if I remove the earliest from search and select the time over "Last 60 minutes" from the GUI, then it says in the following format:
n events(last_hour to current_hour)

Why is that both the output differs since they both mean the same?

[vganjare · Accepted solution]

Hi,

This is happening because of earliest=-1h@h.

e.g., lets say the current time is 13:40:22. Following few examples should explain you the difference:

-1h@h --> 13:00:00
-1h@m --> 13:40:00
-1h@s --> 13:40:22
-1h --> 13:40:22

Thanks!!