relative time modifier
A string of characters that can be added to a search (or saved search definition) to describe relative time ranges for a search--ranges that are dependent on the time that the search is launched, in other words.
For example, a relative time modifier of
-60m means "60 minutes ago" while a relative time modifier of
-7d@d means "one week ago, starting at 12 midnight". You can also set up "chained" relative time modifiers--two relative time modifiers in succession:
-mon@mon+7d means "one month ago, snapped to the first of the month at midnight, and then add seven days," which results in the 8th of last month.
Just like absolute time ranges, relative time ranges are applied to an
earliest and/or a
latest value. If you only specify a
earliest value, then
latest is assumed to be "now" (the moment the search is launched). So a search with
earliest=-60m and no
latest value covers a time range beginning exactly 60 minutes before the search is launched.
For more information
In the User Manual: