March 2018
Beginner to intermediate
576 pages
13h 29m
English
If the Relative presets are not what you need, you can use the custom Relative time range options to specify a time range for your search that is relative to Now. You can select from the list of time range units, Seconds Ago, Minutes Ago, and so on:

Splunk also provides the ability to use Beginning of second (the default) or a No Snap-to time unit to indicate the nearest or latest time to which your time amount rounds up. If you don't specify a snap-to time unit, Splunk snaps automatically to the second. Unlike the Presets, to actually apply your (Relative) selections to the search, you need to click on the Apply button.
Read now
Unlock full access