My Splunk command is :
1)
index=myIndex search base earliest=-1h latest= now
2)
index=myIndex search base earliest=-30m latest= -1h
3)
index=myIndex search base earliest=-30 latest= 30m
↧