Forums / Ideas

graham.poulter

The RTM accepted formats for due dates is rather verbose and limiting.

On the web-app it autocompletes some days of the week, which is helpful.

However, RTM lacks a shorthand for expressing other dates. Splunk has a decent relative date format based on h(hour), d(day), w(week), m(month), y(year), as [+-]N[hdwmy]. So -3d is 3 days ago, +3m is 3 months from now.

It also uses "@" to snap to a particular date in the range. So 2w@w3 is 2 weeks from now, snapping to 3rd day of the week (Tuesday).

Here is the full format:
http://docs.splunk.com/Documentation/Splunk/latest/User/ChangeTheTimeRangeOfYourSearch#Define_custom_relative_time_ranges

Posted at 11:04am on December 18, 2011