How do I set a timerange to be the last full 7 days?

[Peter]

I have a script that populates the previous day's data early in the following morning. How do I set a time range such that I get results from the past 7 full days? Setting "earliest=-7d" still relies on the current time. So if today is Tuesday the 30th, I want to search from midnight last Tuesday to midnight on the 29th.

[hulahoop · Accepted solution]

Try earliest=-7d@d (snap to the beginning of the day).

[gkanapathy · Accepted solution]

You would need to use earliest=-7d@d, but you also need latest=@d to set the end time correctly to the 00:00 today/24:00 yesterday. (I assume that's what you mean by "midnight"; if you meant 00:00 yesterday, then you need latest=-1d@d instead.)

[Johnvey]

The full description of relative time range modifiers is here: http://www.splunk.com/base/Documentation/latest/User/ChangeTheTimeRangeOfYourSearch#Specify_relative...

[hulahoop · Accepted solution]

Try earliest=-7d@d (snap to the beginning of the day).