https://community.splunk.com/t5/Splunk-Search/Defining-search-timeframe-from-midnight-to-now/m-p/46379#M11099 <P>We have situations where we just want to show what happened "today", which is defined as from Midnight to now. That's easy to say in English, and it's easy to define latest=now, but I am having trouble figuring out what to specify as the 'earliest' value to get Splunk to understand midnight. </P> Thu, 17 Feb 2011 23:52:34 GMT beaumaris 2011-02-17T23:52:34Z https://community.splunk.com/t5/Splunk-Search/Defining-search-timeframe-from-midnight-to-now/m-p/46379#M11099 <P>We have situations where we just want to show what happened "today", which is defined as from Midnight to now. That's easy to say in English, and it's easy to define latest=now, but I am having trouble figuring out what to specify as the 'earliest' value to get Splunk to understand midnight. </P> Thu, 17 Feb 2011 23:52:34 GMT https://community.splunk.com/t5/Splunk-Search/Defining-search-timeframe-from-midnight-to-now/m-p/46379#M11099 beaumaris 2011-02-17T23:52:34Z https://community.splunk.com/t5/Splunk-Search/Defining-search-timeframe-from-midnight-to-now/m-p/46380#M11100 <P>Midnight is just zero hours, relative to the current day, so you can use:</P> <PRE><CODE> earliest=-0h@d </CODE></PRE> <P>or just:</P> <PRE><CODE>earliest=@d </CODE></PRE> <P>You should also have <CODE>Today</CODE> available as an option in the TimeRangePicker.</P> Fri, 18 Feb 2011 00:11:48 GMT https://community.splunk.com/t5/Splunk-Search/Defining-search-timeframe-from-midnight-to-now/m-p/46380#M11100 southeringtonp 2011-02-18T00:11:48Z