Relative date and time

TQL supports relative time searches using keywords such as the following.

yesterday

today

last hour

last day

last week

last month

last year

X hours ago

X days ago

X weeks ago

X months ago

X years ago

where X is a number.

start

end

where start is the earliest timestamp to return and end is the latest timestamp to return.

Examples

class=alerts start:'2022-01-01T00:00:00Z' end:'2022-03-31T23:59:59Z'

Returns events from the first three months of 2022.

srccountrycode=ru start:"24 hours ago" end:"1 hour ago"

Limits the search to a maximum of 23 hours of data starting 24 hours ago.