nerdexam
Splunk

SPLK-1001 · Question #164

What is the correct way to use a time range specifier in the search bar so that the search looks back 2 hours?

The correct answer is B. earliest=-2h. Option B is correct because earliest defines the start of the search window - setting it to -2h tells the search engine to begin looking from 2 hours ago up to now, which is exactly a 2-hour lookback. Why the distractors fail: A (latest=-2h): latest defines the end of the…

Question

What is the correct way to use a time range specifier in the search bar so that the search looks back 2 hours?

Options

  • Alatest=-2h
  • Bearliest=-2h
  • Clatest=-2hour@d
  • Dearliest=-2hour@d

How the community answered

(38 responses)
  • A
    8% (3)
  • B
    79% (30)
  • C
    3% (1)
  • D
    11% (4)

Explanation

Option B is correct because earliest defines the start of the search window - setting it to -2h tells the search engine to begin looking from 2 hours ago up to now, which is exactly a 2-hour lookback.

Why the distractors fail:

  • A (latest=-2h): latest defines the end of the search window, so this would search for events older than 2 hours ago - the opposite of the intent.
  • C (latest=-2hour@d): Uses the wrong keyword (latest instead of earliest), and -2hour is not valid syntax (the correct unit abbreviation is h). The @d snap-to-day modifier also shifts the boundary to midnight, not 2 hours back.
  • D (earliest=-2hour@d): Right keyword, but -2hour is invalid syntax and @d snaps to the start of the current day, making the range unpredictable and not reliably 2 hours.

Memory tip: Think of earliest as "earliest event I care about" - it anchors the back of your time window. A negative value like -2h means "2 hours before now," so earliest=-2h naturally reads as "start my search 2 hours ago."

Community Discussion

No community discussion yet for this question.

Full SPLK-1001 Practice