For date and time data fields, such as Detect Time, you can type an actual date value, such as 10/12/2016 8:54:00 AM, or can use special system variables such as:
$CurrentDateTime: for the date and time the report is run; the system variable is replaced by the current date and time value.
$CurrentDate: for the date the report is run; the system variable is replaced with the date value, truncating the time of the day to 0, when the report is scheduled or run.
You can also specify certain date operations with these system variables to add or subtract a number of specified days or hours. For example, you could type: $CurrentDate - 7d for seven days before the date the report is run, the condition evaluates to a date which is the current date minus seven days, or $CurrentDateTime - 12h, which evaluates to the current date time minus 12 hours. Do not create an operation that will result in a time stamp that is out of range (the range is January 1,1970, at 00:00:01 through January 19, 2038 at 03:14:07, UTC), or you will get an error.
The time and date editing window you access through the Detect Time and Detect Time Offset fields of the ArcSight Console's Report Editor can accept month (uppercase M), minute (lowercase m), and current week (uppercase W) parameters.
Use spaces to separate these special system variables or parameters from other operators when including them in a condition statement.
See also Variables and the subtopic on Timestamp Functions.