3.2 Setting Time Ranges

3.2 Setting Time Ranges

Quick Answer: Use the Time Range picker (or earliest/latest in SPL) to bound _time. Presets and relative windows cover most User work; real-time windows stream continuously; snap-to modifiers like -24h@h and -7d@d align boundaries to clock units.

Topic 2.2 Set the time range of a search sits inside the 22% Basic Searching domain. Splunk’s storage and search engine are time-centric: events are stored in time-bounded buckets, and nearly every efficient search starts by limiting earliest and latest.

Why time range is not optional thinking

If two analysts run the same keywords—one with Last 15 minutes, one with All time—they can get radically different runtimes and result volumes. The exam expects you to recognize:

• Where the time control lives in the UI
• What preset / relative / real-time / date-range mean
• How relative modifiers read in SPL (earliest=-24h@h)
• That time filtering uses the event timestamp field _time (not “when you clicked Search,” and not _indextime unless a specialized modifier is used—User focus stays on _time)

The Time Range picker

Immediately beside the Search bar, the Time Range picker dropdown shows the active window (for example, “Last 24 hours”). Opening it reveals tabs/sections commonly including:

After you choose a value, the label on the picker updates. The next time you click Search, the job uses that window.

Presets versus custom relative

Presets are shortcuts for relative (and a few special) windows. They are ideal for ad-hoc investigation and for exam questions that name “Last 24 hours” style options.

Relative (custom) is for windows that are not on the preset list—for example, “beginning 90 minutes ago through now,” or “from 2 days ago to 1 day ago.” Relative controls usually ask for:

• How far back earliest is (amount + unit)
• How far back latest is (often “now”)

Real-time versus historical

Real-time searches keep working until you stop them and can load the system more heavily. Exam items often contrast “Last 15 minutes” (historical) with a “15-minute real-time window” (streaming).

Date Range / Date & Time Range

Use these when you need a calendar-bound investigation: a change window last Tuesday 14:00–16:00, or an entire month for a capacity review. Absolute ranges are exact; relative ranges “move” as wall-clock time advances if you re-run the search later.

earliest and latest: the underlying model

Regardless of UI tab, Splunk converts your choice into earliest and latest bounds evaluated against _time.

Omitting an explicit latest in SPL commonly defaults to now. Omitting earliest without a picker default is dangerous—UI always has some selected range.

Relative time modifiers in SPL

You can embed time in the search string (or in saved-search definitions) using modifiers:

earliest=-15m

earliest=-24h latest=now

earliest=-4h latest=-2h

Common time units

Examples:

• earliest=-30s — last 30 seconds (historical window ending at now if latest omitted/defaulted)
• earliest=-24h — from 24 hours before now
• earliest=-7d — from 7 days before now

Snap-to with @ (critical User skill)

A snap-to anchor rounds the relative time to the start of a unit. Syntax pattern:

-24h@h
-7d@d
-1mon@mon

Read -24h@h as: go back 24 hours, then snap to the beginning of that hour. Read -7d@d as: go back 7 days, then snap to the beginning of that day (typically midnight in the applied timezone context).

Snap-to matters for clean daily/hourly reporting. Without @d, “last 7 days” drifts by the current time of day; with @d, day boundaries line up for apples-to-apples charts.

Combining picker and SPL

If both the picker and SPL specify time, understand that explicit SPL earliest/latest participate in defining the job’s time bounds—practice in your lab how your Splunk version resolves conflicts. For the exam, be fluent reading modifiers and picker labels; questions usually present one clear mechanism.

Worked examples

Example A — Preset
Picker: Last 24 hours. Search: error.
Result: events whose _time falls in the last day, matching error.

Example B — Relative SPL

index=net earliest=-4h latest=-1h firewall DROP

Events from four hours ago up to one hour ago (not the most recent hour).

Example C — Snap-to

index=app earliest=-7d@d latest=@d

From the start of the day seven days ago through the start of today—useful for complete prior days without a partial “today” if latest is @d only (interpret carefully: @d alone as latest often means “beginning of today,” so the window may exclude the partial current day). Adjust latest to now when you need “through this moment.”

Example D — Real-time preset
Picker: 30-second window real-time. Search: sourcetype=syslog.
Events stream as they arrive; stop the job when finished watching.

Performance and investigation discipline

Exam-style traps

1. All time is valid but rarely wise on large indexes—questions may ask what expands the search the most.
2. Real-time is not the same as Last 15 minutes historical.
3. -24h vs -24h@h — only the second snaps to the hour.
4. Time range filters _time, the event timestamp—mis-parsed timestamps at index time can make events “missing” from an expected window (awareness only; parsing deep-dives are beyond basic 2.2 UI skill).

Mini workflow checklist

1. Decide historical vs real-time.
2. Pick preset, relative custom, or absolute date/time.
3. Confirm the picker label before clicking Search.
4. For saved/logical clarity, recognize earliest/latest and snap-to forms like -24h@h and -7d@d.

Time range mastery is the difference between a one-second search and a ten-minute wait—and Domain 2.2 tests that judgment directly.