Every time you execute a search, always be aware that you are running a query against a set of data that is bound by date and time. The time-range picker is on the right side of the search bar. Splunk comes with predetermined time modifiers, as seen in the following screenshot. You can also use the time-range picker to set up a custom date/time-range or other advanced ranges (https://docs.splunk.com/Splexicon:Timerangepicker):
Apart from the All time selection, there are two types of time modifiers that will be used the most: Real-time and Relative. In the preceding screenshot, the predetermined real-time modifiers are in the leftmost column, and the relative time modifiers are in the middle columns.
Real-time modifiers mean that Splunk will run an ongoing, real-time search based on the specified time window. For example, a real-time search that is in a 5 minute...
