Skip to main content
InfraQL supports relative time, UTC dates, RFC 3339 timestamps, and Lucene-style range literals on compatible fields.

​
Relative time

Use now by itself or add and subtract an interval:
Supported units are: Relative values are resolved when the query is compiled.

​
Fixed dates and timestamps

Use an ISO date when whole-day meaning is useful:
A date-only value represents that complete UTC calendar day. For example, tls.not_after<=2026-08-01 includes the whole of 1 August 2026 UTC. Use RFC 3339 for an exact point in time:
InfraQL also accepts YYYY-MM-DD HH:MM:SS where the field policy allows a timestamp.

​
Range literals

Square brackets include a boundary. Curly braces exclude it:
Use * for an open boundary:
[* TO *] is an existence query.
Range literals use the : operator. Use comparison operators for a single bound, such as timestamp>=now-24h.

​
Observation fields

Choose the field whose clock matches the question: The exact field name depends on the dataset. Browse the Data Dictionary before using time logic in automation.