Hi All ,
I have running a search to grab events for the last 1 hour. so in my search i am using earliest=-1h@h
. It says in the following format:
n events (before current date/time)
However, if I remove the earliest from search and select the time over "Last 60 minutes" from the GUI, then it says in the following format:
n events(last_hour to current_hour)
Why is that both the output differs since they both mean the same?
Hi,
This is happening because of earliest=-1h@h.
e.g., lets say the current time is 13:40:22. Following few examples should explain you the difference:
-1h@h --> 13:00:00
-1h@m --> 13:40:00
-1h@s --> 13:40:22
-1h --> 13:40:22
Thanks!!
Hi,
This is happening because of earliest=-1h@h.
e.g., lets say the current time is 13:40:22. Following few examples should explain you the difference:
-1h@h --> 13:00:00
-1h@m --> 13:40:00
-1h@s --> 13:40:22
-1h --> 13:40:22
Thanks!!