Answer by warren for Splunk relative times with + are incorrect in dashboard (out by a week)

Not sure exactly what you’re seeing, but the lone example on Docs.Splunk for relative_time uses a negative value.

That said, if you want to "look into the future" with your searches, why not just add 1 to argh1 – since you’ve already eval‘d it, you "know" it’s now().

Something like this, perhaps:

| eval argh1=now()
| eval argh2=argh1-1, argh3=argh1+1

from User warren – Stack Overflow https://stackoverflow.com/questions/65359627/splunk-relative-times-with-are-incorrect-in-dashboard-out-by-a-week/65395510#65395510
via IFTTT