Lookback questions almost always start with a timestamp someone already has. Support sees an alert at 9:30 AM and needs when the job started if the run lasted three hours twenty. Finance reconciles a posted time against "six hours prior." A developer reads "deploy finished at 22:15" and wants the window start for a grep filter. The fields above step backward from one anchor datetime and return the earlier calendar line you can paste into a query or ticket.
This is datetime math, not clock-only subtraction on one afternoon. The calendar day can change when you cross midnight going backward. What you type is what the math uses—no timezone conversion—so match the zone of the log or database column before you copy the answer.
The default on the form—3 hours 20 minutes before May 9, 2026 at 9:30 AM—is around 6:10 AM the same morning, the sort of reconstruction people still double-check after rounding in chat.
When the friendly label is not the filter bound
Interfaces say "2 hours ago" while exports store UTC. The words are for humans; the filter needs an actual instant. Running the anchor once beats guessing from memory. Shorter lookbacks with only minutes in the rule fit the lighter page—45 minutes before that same morning stamp—when you do not need an hour field.
Forward moves belong elsewhere. 3 hours 20 minutes after the same anchor is the mirror for deadlines, not lookbacks. Evening anchors still flip the date when you go back: six hours before May 9 at 10:00 PM lands on the afternoon of the ninth, easy to mis-type as "still the tenth" in a hurry.
Put the event in the base field
The reference datetime should be the moment named in the note—the alert time, export row, or message timestamp—not an arbitrary "now" unless you deliberately set the picker to the current minute. Clock-only subtraction on one day is the subtract-time habit; whole days without a time belong on the days-ago calculators.
- Hours and minutes stack; combine awkward pieces before you paste.
- Read the detail line—it restates the span you removed.
- Copy anchor plus offset beside the answer for the thread Friday.
Audit threads are where display copy and query bounds fight; the audit trail time-ago note is worth a skim when "2 days ago" in the UI has to match exported values.
Ordinary reference math, not legal advice. When the instant matters, keep the reference stamp and the hours/minutes you subtracted with the result.