Skip to content

[FEATURE] Support earliest and latest in search command #4135

@yuancu

Description

@yuancu

Is your feature request related to a problem?

Currently, earliest and latest options are supported in conditions (doc) and aggregation functions (#4100), but not yet supported in search command. E.g. search source=emps earliest=-1d

What solution would you like?

Support earliest and latest parameter in search command

  • absolute time: search source=emps earliest=2020-12-10
  • relative time: search source=emps earliest=-30s
  • relative time aligned to weekday: search source=emps earliest=@w2 (Tuesday of the current week)
  • keyword: search source=emps earliest=2020-12-10 latest=now
  • keyword combined with modifier: search source=emps earliest=2020-12-10 latest=now-1d
  • implicit time with alignment: search source=emps latest=-1h@h (one hour in the past, aligned to hour)

What alternatives have you considered?

--

Do you have any additional context?

--

Metadata

Metadata

Assignees

Labels

PPLPiped processing languageenhancementNew feature or requestv3.3.0

Type

No type

Projects

Status

New

Status

Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions