How to Specify time modifiers in Splunk search?

When searching or saving a search, you can specify absolute and relative time ranges using the following time modifiers:

  • earliest=time_modifier
  • latest=time_modifier

Examples of relative time modifiers

Examples of chained relative time offsets

Rajesh Kumar
Follow me