Is there a time range specifier for "last 24 hours of available data"?

[HXCaine]

I would like to display a chart for only the last 24 hours of data, but I don't want the charts to be empty if I haven't imported the data today, I'd like it to just show the last available 24 hours' worth of data.

(This is because the data is currently coming from another machine and I have to manually import log files for the moment.)

How can I specify "last 24 hours of data that is available"?

[Ayn · Accepted solution]

There's nothing built-in that I know of, in part because this kind of usage differs somewhat from how Splunk is used in a typical case.

What you could do is get the newest event in the index, grab its timestamp and then search on any events that have a timestamp that's at most 24 hours older than that. Something like this should work:

_time>[search * | head 1 | eval _time=_time-86400 | return $_time]

[HXCaine]

Just a note for anybody using this: using 'search *' will search all sourcetypes, so if you have newly indexed data in another sourcetype you may get no data returned in your query. Instead, use 'search sourcetype="blah" | head 1 ...' and it will search specifically within this sourcetype

[jonuwz]

+1 cool. was unaware of return $...
no more messing around with query=... | format "" "" "" "" "" "" .....