SPLK-1001 · Question #164
What is the correct way to use a time range specifier in the search bar so that the search looks back 2 hours?
The correct answer is B. earliest=-2h. Option B is correct because earliest defines the start of the search window - setting it to -2h tells the search engine to begin looking from 2 hours ago up to now, which is exactly a 2-hour lookback. Why the distractors fail: A (latest=-2h): latest defines the end of the…
Question
What is the correct way to use a time range specifier in the search bar so that the search looks back 2 hours?
Options
- Alatest=-2h
- Bearliest=-2h
- Clatest=-2hour@d
- Dearliest=-2hour@d
How the community answered
(38 responses)- A8% (3)
- B79% (30)
- C3% (1)
- D11% (4)
Explanation
Option B is correct because earliest defines the start of the search window - setting it to -2h tells the search engine to begin looking from 2 hours ago up to now, which is exactly a 2-hour lookback.
Why the distractors fail:
- A (
latest=-2h):latestdefines the end of the search window, so this would search for events older than 2 hours ago - the opposite of the intent. - C (
latest=-2hour@d): Uses the wrong keyword (latestinstead ofearliest), and-2houris not valid syntax (the correct unit abbreviation ish). The@dsnap-to-day modifier also shifts the boundary to midnight, not 2 hours back. - D (
earliest=-2hour@d): Right keyword, but-2houris invalid syntax and@dsnaps to the start of the current day, making the range unpredictable and not reliably 2 hours.
Memory tip: Think of earliest as "earliest event I care about" - it anchors the back of your time window. A negative value like -2h means "2 hours before now," so earliest=-2h naturally reads as "start my search 2 hours ago."
Community Discussion
No community discussion yet for this question.