Using the Splunk Time Range Picker
Learn how to use Splunk's time range picker to search preset, relative, real-time, date, and exact date-and-time periods.
The time range picker is the Splunk search interface control used to set the earliest and latest time boundaries for a search. Splunk uses the selected boundaries to determine which events are included.
Choosing a range that matches the likely incident window reduces unrelated results and can make an investigation faster. Splunk applies the time range before you interpret the search results, so select an appropriate period before running or rerunning the search.
Find the time range picker
In the Splunk Search interface, the time range picker is beside the search bar. The default selection is All time, which searches across all available event time covered by the selected data.
Open the picker to choose a preset or define a custom range. The selection applies when you run the search and can be changed before rerunning it.
For a refresher on opening the search interface, see Access Splunk Web Interface and Launch Search App.
Splunk time range picker options
Preset time ranges
A preset time range is a ready-made period provided by the picker. Presets are useful when the period is common and does not require manually entering boundaries.
Yesterday versus Last 24 hours
Yesterday is calendar-based: it covers the previous calendar day. Last 24 hours is a rolling duration: it covers the 24 hours immediately before the search runs.
For example, if it is currently Tuesday at 15:00:
- Yesterday refers to Monday's calendar day.
- Last 24 hours refers approximately to the period from Monday at 15:00 through Tuesday at 15:00.
Use Yesterday when an issue is known to have occurred during the prior calendar day. Use Last 24 hours when you need the most recent rolling day.
Relative time ranges
A relative time range calculates its boundaries from the current time when the search runs. You define an earliest time, which is the beginning boundary, and a latest time, which is the ending boundary.
To search from five hours ago through the present, open the picker and configure:
Earliest: 5 hours ago
Latest: nowThis creates a rolling five-hour window. Relative ranges are useful for recurring operational searches and recent troubleshooting because the same selection moves forward as time passes.
If the search is scheduled or rerun later, the boundaries are recalculated relative to that later run time. Check the displayed selection when the exact period matters.
Real-time ranges
A real-time range is a rolling, continuously updating window of newly arriving events. It is appropriate when you are watching an active system and need results to update as events arrive.
The selected real-time window controls how far back the rolling view includes events. For example, a short real-time window can show only the latest incoming activity, while a longer window includes more recent history as well as new events.
Use a completed historical search instead when the incident has ended and you need stable results for investigation, comparison, reporting, or documentation. A relative or custom historical range is generally more suitable for a finished outage.
Custom date ranges
Select Date Range when you know the calendar dates but do not need to specify exact times. Choose a start date and an end date in the picker.
This option works well for:
- Reviewing a particular day.
- Examining a multi-day incident period.
- Starting with a calendar-level investigation before narrowing to specific times.
The selected boundaries determine which dates are included. If events are missing near the beginning or end of the investigation, widen the date range and check whether the issue crossed a date boundary.
Custom date-and-time ranges
Select Date & Time Range when the issue began and ended at known times. Enter the exact start date and time for the earliest time and the exact end date and time for the latest time.
For a known outage, set the earliest boundary to the outage start date and time and the latest boundary to the outage end date and time. This isolates events generated during the specific incident window and avoids unrelated activity before or after it.
Choosing the right range type
A practical workflow is to start with an approximate period, inspect the results, and then refine the range:
- Choose a preset when a common period is sufficient.
- Use a relative range for a rolling period measured back from now.
- Use a date range when the relevant calendar dates are known.
- Use a date-and-time range when the incident window is precise.
- Widen or narrow the boundaries based on the results.
Troubleshooting time-range problems
Too many unrelated events appear
The picker may still be set to All time, or the selected range may be broader than the incident window. Choose a matching preset, relative range, date range, or date-and-time range.
Expected events do not appear
The earliest or latest boundary may exclude the relevant period. Widen the range, then verify whether the incident occurred on another date or at a different time than expected.
Yesterday does not match the previous 24 hours
This is expected: Yesterday is a calendar-based range, while Last 24 hours is a rolling duration. Choose the option that matches the question you are investigating.
Results do not keep updating
A historical or relative range was probably selected. Choose an appropriate real-time range when continuous monitoring of incoming events is required.
Exam-relevant notes
- The time range picker sets the earliest and latest time boundaries for a search.
- All time is the default range.
- Yesterday is calendar-based; Last 24 hours is rolling.
- Relative ranges are calculated from the current time when the search runs.
- Real-time ranges continuously update and show a rolling view of incoming events.
- Date Range uses calendar dates; Date & Time Range uses exact dates and times.
- Always verify the boundaries before running a search intended to isolate an incident.
After selecting the appropriate period, enter and run your search. The range works with the search interface and helps limit the event set before you analyze fields, commands, or returned results.