Hi,
I would like to set the timerange picker that my search is always using data from date "X" until yesterday 24:00. How can I achieve this?
Best
Heinz
"Yesterday 24:00" is expressed as @d in Splunk relative time syntax. It's the same point in time as "Today 00:00", when used as the right bound of a search it's exclusive.
When using the verbose date-and-time configuration you select the "to" date as today 00:00, and the "from" date as your date X 00:00.
"Yesterday 24:00" is expressed as @d in Splunk relative time syntax. It's the same point in time as "Today 00:00", when used as the right bound of a search it's exclusive.
When using the verbose date-and-time configuration you select the "to" date as today 00:00, and the "from" date as your date X 00:00.
Hi Martin,
sounds easy 🙂 Then I will use the advanced timerangepicker and set earliest:"unixtime" latest:@d.
Thanks a lot