relative time modifier

noun

A string of characters that can be added to a search (or saved search definition) to describe relative time ranges for a search--ranges that are dependent on the time that the search is launched, in other words.

For example, a relative time modifier of -60m means "60 minutes ago" while a relative time modifier of -7d@d means "one week ago, starting at 12 midnight". You can also set up "chained" relative time modifiers--two relative time modifiers in succession: -mon@mon+7d means "one month ago, snapped to the first of the month at midnight, and then add seven days," which results in the 8th of last month.

Just like absolute time ranges, relative time ranges are applied to an earliest and/or a latest value. If you only specify a earliest value, then latest is assumed to be "now" (the moment the search is launched). So a search with earliest=-60m and no latest value covers a time range beginning exactly 60 minutes before the search is launched.

For more information

In the User Manual:

configuration

configuration file

event processing

character set encoding

segmentation

segment

timestamping

timestamp, timezone offset

default field extraction

host, source, source type, punct


archiving

retention time