The Time Macros app provides a set of globally shared eval based macros for doing time maths. For a long-form motiviational take on this see @duckfez' blog post: https://www.duanewaddle.com/searching-date-time-values-in-splunk/ See the Details tab up top for a list of macros and their description as well as real-world usage examples.