for example: if the current time 5:23:20 PM, how can i get the time 4:55:00 PM. and if the current time 5:26:12 PM, how can i get time 5:20:00 PM, and so on
i know splunk provide one minute time uint. for example -5m@m. if there is 5 minute time unit, or some alternative way to get same result?
I don't think there is an straightforward way. However, you can express it first by finding out how many seconds are in your "snap-to" unit. For something like
earliest=-15m@5m latest=-10m@5m, you can do
sourcetype=mysourcetype [ stats count | eval earliest=5*60*(floor(now()-(15*60)/(5*60))) | eval latest=5*60*(floor(now()-(10*60)/(5*60))) | fields earliest latest ]
Your examples don't seem to be consistent. Also, what's the context you are trying to do this in? Are you trying to set the timeframe for a search, or are you talking about date manipulation using fields with a search?