Splunk® Enterprise

Search Reference

Acrobat logo Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF

Time modifiers

Use time modifiers to customize the time range of a search or change the format of the timestamps in the search results.

_time and _indextime fields

When an event is processed by Splunk software, its timestamp is saved as the default field _time. This timestamp, which is the time when the event occurred, is saved in UNIX time notation. Searching with relative time modifiers, earliest or latest, finds every event with a timestamp beginning, ending, or between the specified timestamps.

For example, when you search for earliest=-4h, the search finds every event with a _time value in the last four hours.

You also have the option of searching for events based on when they were indexed. The UNIX time is saved in the _indextime field. Similar to earliest and latest for the _time field, you can use the relative time modifiers _index_earliest and _index_latest to search for events based on _indextime. For example, if you wanted to search for events indexed in the previous hour, use: _index_earliest=-h _index_latest=now().

Note: When using index-time based modifiers such as index_earliest and index_latest, your search must also have an event-time window which will retrieve the events. In other words, chunks of events might be ruled out based on the non index-time window as well as the index-time window. To be certain of retrieving every event based on index-time, you must run your search using All Time.

List of time modifiers

Use the earliest and latest modifiers to specify custom and relative time ranges. You can specify an exact time such as earliest="10/5/2016:20:00:00", or a relative time such as earliest=-h or latest=-15m.

When specifying relative time, you can use the now() modifier to refer to the current time.

Modifier Syntax Description
earliest earliest=[+|-]<time_integer><time_unit> Specify the earliest _time for the time range of your search.
_index_earliest _index_earliest=[+|-]<time_integer><time_unit> Specify the earliest _indextime for the time range of your search.
_index_latest _index_latest=[+|-]<time_integer><time_unit> Specify the latest _indextime for the time range of your search.
latest latest=[+|-]<time_integer><time_unit> Specify the latest time for the _time range of your search.
now now() Refers to the current time. If set to earliest, now() is the start of the search.
time time() In real-time searches, time() is the current machine time.

For more information about customizing your search window, see Specify real-time time range windows in your search in the Search Manual.

How to specify relative time modifiers

You can define the relative time in your search with a string of characters that indicate time amount (integer and unit).

The syntax for using time modifiers is [+|-]<time_integer><time_unit>

The steps to specify a relative time modifier are:

  1. Indicate the time offset from the current time.
  2. Define the time amount, which is a number and a unit.

Indicate the time offset

Begin your string with a plus (+) or minus (-) to indicate the offset from the current time.

Define the time amount

Define your time amount with a number and a unit. The supported time units are:

  • second: s, sec, secs, second, seconds
  • minute: m, min, minute, minutes
  • hour: h, hr, hrs, hour, hours
  • day: d, day, days
  • week: w, week, weeks
  • month: mon, month, months
  • quarter: q, qtr, qtrs, quarter, quarters
  • year: y, yr, yrs, year, years

For example, to start your search an hour ago, use either of the following time modifiers.




When specifying single time amounts, the number one is implied. An 's' is the same as '1s', 'm' is the same as '1m', 'h' is the same as '1h', and so forth.


1. Search the events from the last 7 days


2. Search with an exact date as a boundary

With a boundary such as from November 5 at 8 PM to November 12 at 8 PM, use the timeformat %m/%d/%Y:%H:%M:%S.

earliest="11/5/2017:20:00:00" latest="11/12/2017:20:00:00"

3. Specify multiple time windows

You can specify multiple time windows using the timeformat %m/%d/%Y:%H:%M:%S. For example to find events from 5-6 PM or 7-8 PM on specific dates, use the following syntax.

(earliest=“1/22/2018:17:00:00" latest="1/22/2018:18:00:00") OR (earliest="1/22/2018:19:00:00" latest="1/22/2018:20:00:00")

Other time modifiers

These search time modifiers are still valid, but might be removed and their function no longer supported in a future release.

Modifier Syntax Description
daysago daysago=<int> Search events within the last integer number of days.
enddaysago enddaysago=<int> Set an end time for an integer number of days before Now.
endhoursago endhoursago=<int> Set an end time for an integer number of hours before Now.
endminutesago endminutesago=<int> Set an end time for an integer number of minutes before Now.
endmonthsago endmonthsago=<int> Set an end time for an integer number of months before Now.
endtime endtime=<string> Search for events before the specified time (exclusive of the specified time). Use timeformat to specify how the timestamp is formatted.
endtimeu endtimeu=<int> Search for events before the specific UNIX time.
hoursago hoursago=<int> Search events within the last integer number of hours.
minutesago minutesago=<int> Search events within the last integer number of minutes.
monthsago monthsago=<int> Search events within the last integer number of months.
searchtimespandays searchtimespandays=<int> Search within a specified range of days, expressed as an integer.
searchtimespanhours searchtimespanhours=<int> Search within a specified range of hours, expressed as an integer.
searchtimespanminutes searchtimespanminutes=<int> Search within a specified range of minutes, expressed as an integer.
searchtimespanmonths searchtimespanmonths=<int> Search within a specified range of months, expressed as an integer.
startdaysago startdaysago=<int> Search the specified number of days before the present time.
starthoursago starthoursago=<int> Search the specified number of hours before the present time.
startminutesago startminutesago=<int> Search the specified number of minutes before the present time.
startmonthsago startmonthsago=<int> Search the specified number of months before the present time.
starttime starttime=<timestamp> Search from the specified date and time to the present, inclusive of the specified time.
starttimeu starttimeu=<int> Search for events starting from the specific UNIX time.
timeformat timeformat=<string> Set the timeformat for the starttime and endtime modifiers. By default: timeformat=%m/%d/%Y:%H:%M:%S


Last modified on 13 February, 2018
Date and time format variables

This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters