---
title: "Fine-Tune Context Graph Searches with Time Filters"
slug: "fine-tune-context-graph-searches-with-time-filters"
tags: ["Date Formats", "Date Time Formats", "Time Filtering", "Web Search"]
updated: 2026-06-09T03:01:37Z
published: 2026-06-09T03:01:37Z
canonical: "help.silentpush.com/fine-tune-context-graph-searches-with-time-filters"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.silentpush.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fine-Tune Context Graph Searches with Time Filters

Silent Push's Web Search (via Web Search and Live Scan) allows precise control over query time frames to focus on recent threats or historical trends. This article details supported date/time formats, parameters, and best practices for efficient investigations.

Time filtering in Web Scanner queries uses SPQL syntax in the Command Line interface or UI Constructor. Filters apply to data sources such as clearnet/Dark Web scans, ensuring results align with your timeframe (e.g., the last 24 hours for emerging risks).

## Supported Date/Time Formats and Operators

SPQL supports flexible temporal operators for granularity:

### Operators

- `since:` – Results from this date onward (inclusive)
- `until:` – Results up to this date (exclusive)
- `last_24_hours` – Pre-built for immediate recency
- `within_time:Xd` – Relative (e.g., `7d` for past week)

### Formats

- `YYYY-MM-DD` (e.g., `since:2025-09-01`)
- `YYYY-MM-DDTHH:MM:SS` (ISO 8601, e.g., `until:2025-09-29T12:00:00`)
- Relative: `Xd` / `XM` / `XY` / `XH` (e.g., `since:30d`)

> [!NOTE]
> All times are in UTC. Timezone offsets are not currently supported.

You can combine these with source-specific fields such as `last_seen` or `date_added` for even finer control.

## Examples

- **Basic recent scan:** `domain:example.com since:2025-09-22` – Web content from the past week
- **Precise window:** `favicon_hash:abc123 until:2025-09-29T00:00:00 since:2025-09-01T00:00:00` – Impersonation checks for September
- **Live Scan relative:** In the UI, toggle “Last 24 hours” for real-time URL analysis
- **API query:** `GET /webscan?query="ip:192.0.2.1 within_time:1d"` – IPs active today

> [!NOTE]
> Tips
> 
> - Narrow time frames (e.g., `7d`) dramatically speed up large scans; very broad ranges (all-time) may be queued.
> - Use Web Search for anything older than the last 24 hours.
> - Always test complex filters in Constructor mode to catch syntax errors early.

## 

A real-time analysis tool that scans a specific URL to capture current data, such as screenshots, HTML titles, favicons, redirect chains, and SSL details, for immediate threat validation.

The query language used to construct precise searches across threat intelligence data sources, enabling advanced analysis via API or CLI.

A hidden part of the internet, accessible only through special software, where illicit activities, such as the sale of stolen data or malware, often occur, monitored by threat intelligence teams.