When searching the DNS query log, it's easy to define a relative timeframe (ex: Last 4 hours). Once that timeframe is set though, when you click refresh it maintains the same 4 hour window from when that option was originally chosen. Clicking refresh should also refresh the 4 hour window to be NOW-4 hours from the time the refresh occured.