In Splunk, the syntax -30m@h represents a relative time specifier that indicates a time range relative to the current time.
In this specific case, the "-30m" part means 30 minutes ago, and the "@h" part means the beginning of the current hour. So, "-30m@h" represents a time range that starts 30 minutes ago from the beginning of the current hour and ends at the beginning of the current hour.
For example, if the current time is 2:45 PM, "-30m@h" would represent the time range from 2:00 PM to 2:30 PM. so answer is Yes it will look at time from 3.00-3.30
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Alexi2415
Highly Voted 7 months, 4 weeks agoAlex_Cyber_Sec
Most Recent 2 years, 4 months ago