Implementing Splunk 7(Third Edition)
上QQ阅读APP看书,第一时间看更新

Relative

If the Relative presets are not what you need, you can use the custom Relative time range options to specify a time range for your search that is relative to Now. You can select from the list of time range units, Seconds Ago, Minutes Ago, and so on:

Splunk also provides the ability to use Beginning of second (the default) or a No Snap-to time unit to indicate the nearest or latest time to which your time amount rounds up. If you don't specify a snap-to time unit, Splunk snaps automatically to the second. Unlike the Presets, to actually apply your (Relative) selections to the search, you need to click on the Apply button.