Insert time modifier
- Click a chip (e.g.
-1h,@d) to pick a relative time. - Or pick an absolute date/time and choose an output format.
- Hit Insert as earliest= or latest= to drop it at your cursor.
- Splunk and ISO formats are auto-quoted (string literals); epoch is left bare (number).
- Your surrounding query text is preserved, no overwrite.
Quick relative
Snap-to
Absolute date and time
Output format
search