Understanding Search - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 35

• Lastly, we have Advanced search language .
If you noticed, we have selected the 2 for the Hour(s) ago option, and Minute for the
Snap to option in the Relative tab. The search language equivalent for this selection
is -2h@m , which means "go back 2 hours (7,200 seconds) from this moment, and
then snap to the beginning of the minute that second falls in". So, given the time
15:11:23 , the relative time would 13:11:00 . The language is very powerful and
can be used whenever a search is specified.
Specifying time in-line in your search
You can also directly use relative and exact times in your searches. For instance,
given the search item bob error , you can specify directly in the search the time
frame you want to use, using the fields earliest and latest .
• To search for errors affecting bob in the last 60 minutes, use earliest=-60m
bob error
• To search for errors affecting bob in the last 3 hours, snap to the beginning of
the hour using earliest=-3h@h bob error
• To search for errors affecting bob yesterday, use earliest=-1d@d latest=-
0d@d bob error
• To search for errors affecting bob since Monday at midnight, use
earliest=-0@w1 bob error