SPLK-1004 · Question #69
Assuming a standard time zone across the environment, what syntax will always return ewnts from between 2:00am and 5:00am?
The correct answer is B. earliest=-2h@h AND latest=-5h@h. To always return events from between 2:00 AM and 5:00 AM, assuming a standard time zone across the environment, the correct Splunk search syntax is earliest=-2h@h AND latest=-5h@h (Option B). This syntax uses relative time modifiers to specify a range starting 2 hours ago from…
Question
Assuming a standard time zone across the environment, what syntax will always return ewnts from between 2:00am and 5:00am?
Options
- Adatehour>-2 AND date_hour<5
- Bearliest=-2h@h AND latest=-5h@h
- Ctime_hour>-2 AND time_hour>-5
- Dearliest=2h@ AND latest=5h3h
How the community answered
(18 responses)- A17% (3)
- B72% (13)
- D11% (2)
Explanation
To always return events from between 2:00 AM and 5:00 AM, assuming a standard time zone across the environment, the correct Splunk search syntax is earliest=-2h@h AND latest=-5h@h (Option B). This syntax uses relative time modifiers to specify a range starting 2 hours ago from the current hour (-2h@h) and ending 5 hours ago from the current hour (-5h@h), effectively capturing the desired time window.
Topics
Community Discussion
No community discussion yet for this question.