Reporting

What is the chained relative time range command for a search from two months ago?

neilsussman
Explorer

Hi,

I'm scheduling a search from December 1 - January 1 but cannot find the right time range. I tried Start Time -2mon@1mon and Finish Time @1mon but that didn't work. Can someone please let me know how to schedule a search for a specified month range?

Thanks!

0 Karma

lguinn2
Legend

Try this

earliest=-2mon@mon latest=-1mon@mon

Also, when you are building the search, click the Time Range picker and choose "Custom Time". In the Custom Time popup, you can pick an absolute time range. But you can also choose "Relative Time." The cool thing about the relative time selection is that it will show you the actual time equivalent. It's an easy way to confirm that -2mon@mon is actually December 1, for example.

neilsussman
Explorer

That worked perfectly! Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...