VMware ESXi and vSphere Cluster Management

Using the Time Range Picker in Splunk Searches

Learn how Splunk's time range picker sets search boundaries using all-time, preset, relative, real-time, date, and precise date-and-time ranges.

The time range picker is the search interface control used to set the time limits for returned events. It appears next to the search bar in Splunk. Before running a search, use it to define when events must have occurred.

Narrowing the time window helps focus an investigation on the period when an issue occurred. It can also reduce the number of events Splunk must examine and make search results easier to interpret.

Default search time range: All time

Splunk searches use All time by default when no narrower range is selected. This setting searches across all available indexed time, so results may include events from a very large period.

Time range picker options

Range type	When to use it	Example selection	Boundary behavior
All time	When the investigation may involve any indexed period	All time	No narrower time boundary is applied; Splunk searches all available indexed time.
Preset time ranges	When a common, ready-made period matches the investigation	Yesterday; Last 24 hours	Splunk applies the boundaries defined by the selected preset.
Relative time ranges	When the window should be measured from the current time	Earliest time: 5 hours ago	The boundary moves as the current time changes when the search is run again.
Real-time ranges	When monitoring events as they arrive	A real-time window	The search uses a moving window rather than a fixed historical window.
Date Range	When calendar dates are sufficient	A start date and an end date	The search uses a fixed period defined by calendar start and end dates.
Date & Time Range	When the investigation requires precise boundaries	Start and end dates with exact times	The search uses fixed start and end timestamps.

Preset time ranges

A preset time range is a predefined, commonly used search window. Open the time range picker next to the search bar and choose a preset that matches when the event or issue happened.

Yesterday

Choose Yesterday when the investigation concerns the previous calendar day. This is a calendar-based choice: it represents that day rather than an arbitrary 24-hour period ending now.

Last 24 hours

Choose Last 24 hours when you need the rolling 24-hour period immediately before the current time. It may include part of today and part of yesterday, so it is not necessarily the same period as Yesterday.

Relative time ranges

A relative time range expresses a boundary in relation to the current time. For example, an earliest boundary of 5 hours ago means that the search begins five hours before the current time.

Example: search the previous five hours

Open the time range picker next to the search bar.
Choose Relative.
Set Earliest time to 5 hours ago.
Run the search with the resulting relative window.

Earliest time is the beginning boundary of the selected search window. In this example, it limits the search to events from the previous five hours. Relative boundaries are useful when the required duration is not represented by a preset.

Time range type: Relative
Earliest time: 5 hours ago

Real-time ranges

Real-time ranges are available for searches that monitor events as time advances. Unlike a fixed historical window, a real-time search uses a moving time window. New events can enter the window while older events leave it as the window advances.

Use a real-time range for ongoing monitoring rather than for a fixed historical investigation with known start and end boundaries.

Custom date ranges

Date Range

Choose Date Range when only calendar dates are needed. Enter an explicit start date and end date to define a fixed search period. This is appropriate when an incident is known to have occurred during particular days but the exact times are not important.

Date & Time Range

Choose Date & Time Range when the investigation needs more precise boundaries. Enter the exact start date and time and the exact end date and time. This is useful when an incident interval is known, such as a service problem from 14:10 to 14:35 on a particular date.

Choosing the appropriate range

Base the choice on the approximate occurrence time of the issue:

Need	Recommended choice	Example
Previous calendar day	Yesterday	Investigating an issue believed to have happened yesterday
Previous rolling 24 hours	Last 24 hours	Reviewing events from the preceding day, measured backward from now
Previous five hours	Relative	Set Earliest time to `5 hours ago`
Exact known incident interval	Date & Time Range	Enter the exact start and end timestamps

Use a preset when a standard window fits the investigation. Use a relative range when the needed duration is measured backward or forward from the current time. Use Date Range or Date & Time Range when the incident boundaries are known and should remain fixed. If none of the presets matches the incident window, choose a custom or relative range.

Troubleshooting time-window problems

A search returns too many events

The search may be using All time or another overly broad range. Select a narrower preset, a relative range, or a custom date and time window based on when the issue occurred.

Expected events are missing

The selected boundaries may not include the event occurrence time. Expand the range or select a range that matches the approximate or exact incident period. Also verify whether the event occurred near the beginning or end boundary.

Yesterday and Last 24 hours return different results

These options describe different windows. Yesterday refers to the previous calendar day, while Last 24 hours refers to a rolling duration ending at the current time. Choose the option that matches the intended investigation window.

Key points

The time range picker is next to the search bar and controls the time boundaries for a search.
All time is the default and searches all available indexed time.
Presets such as Yesterday and Last 24 hours provide ready-made windows.
Relative ranges express boundaries such as 5 hours ago in relation to the current time.
Real-time ranges use a moving window for monitoring.
Date Range uses fixed calendar dates; Date & Time Range uses exact dates and times.
Choose a range that includes the likely incident period without searching unnecessarily broad time.

For related practice, see the Splunk time range picker guide.