Somewhere in the Modbus documentation for your PLC, there should be an explanation of which memory addresses correspond to Modbus commands. In a Modicon PLC, the holding registers that Jim referred to would be registers with addresses in the range 4xxxx.
In PLCs that support the Modbus protocol, but don't use the Modicon addressing scheme, you need to know which address corresponds to Modicon's 40000.
It may be necessary for you to move Timer/Counter values into holding registers to make the values accessible via Modbus.