when Im using an earliest time value of -1mon, what does it do in cases like March 31st?

[sideview]

on March 13th, -1mon maps to February 13th, at whatever the current time of day is. And -1mon@d maps to February 13th 12AM.

In the dashboard we're dealing with, this is basically what we want.

However it seems like on March 29th, 30th and 31st, ie in cases where that date didnt exist in the previous month it seems splunkd must do something a little arbitrary.

So just to confirm, on all 3 of these days (3/29, 3/30, 3/31) does -1mon just map each to March 1st 12AM?

[jrodman · Accepted solution]

According to: http://docs.splunk.com/Documentation/Splunk/5.0/Search/Specifytimemodifiersinyoursearch#Specify_rela...

Important: When snapping to the nearest or latest time, Splunk always snaps backwards or rounds down to the latest time not after the specified time. For example, if it is 11:59:00 and you "snap to" hours, you will snap to 11:00 not 12:00.

If this applies, then you would expect it to snap March 29, 30, and 31 to February 28, 11:59:59 PM. In the leap year case, March 29 would map to February 29, at the same time of day.