> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Time and ranges

> Search relative windows, fixed dates, timestamps, and bounded ranges

InfraQL supports relative time, UTC dates, RFC 3339 timestamps, and
Lucene-style range literals on compatible fields.

## Relative time

Use `now` by itself or add and subtract an interval:

```text theme={null}
timestamp>=now-15m
timestamp>=now-24h
timestamp>=now-7d
timestamp>=now-2w
tls.not_after<=now+30d
```

Supported units are:

| Unit | Meaning |
| ---- | ------- |
| `s`  | Seconds |
| `m`  | Minutes |
| `h`  | Hours   |
| `d`  | Days    |
| `w`  | Weeks   |
| `M`  | Months  |
| `y`  | Years   |

Relative values are resolved when the query is compiled.

## Fixed dates and timestamps

Use an ISO date when whole-day meaning is useful:

```text theme={null}
timestamp:2026-07-24
```

A date-only value represents that complete UTC calendar day. For example,
`tls.not_after<=2026-08-01` includes the whole of 1 August 2026 UTC.

Use RFC 3339 for an exact point in time:

```text theme={null}
timestamp>="2026-07-24T12:30:00Z"
```

InfraQL also accepts `YYYY-MM-DD HH:MM:SS` where the field policy allows a
timestamp.

## Range literals

Square brackets include a boundary. Curly braces exclude it:

```text theme={null}
timestamp:[now-7d TO now]
timestamp:{2026-07-01 TO 2026-07-24]
```

Use `*` for an open boundary:

```text theme={null}
tls.not_after:[* TO now+14d]
```

`[* TO *]` is an existence query.

<Note>
  Range literals use the `:` operator. Use comparison operators for a single
  bound, such as `timestamp>=now-24h`.
</Note>

## Observation fields

Choose the field whose clock matches the question:

| Field concept        | Use it for                                            |
| -------------------- | ----------------------------------------------------- |
| Service scan time    | When an individual service observation was collected  |
| Host first seen      | When Infrawatch first observed the host               |
| Host last seen       | When Infrawatch most recently observed the host       |
| DNS first seen       | When a DNS relationship segment began                 |
| DNS last seen        | When that DNS relationship was most recently observed |
| Certificate validity | The certificate's own not-before or not-after date    |

The exact field name depends on the dataset. Browse the
[Data Dictionary](/data-dictionary) before using time logic in automation.