I have set this alert up, which i want to show me the results of "today"
index=_internal source="*license_usage.lo*" type=Usage pool="Linux Pool"| stats sum(b) as bytes | eval gb=bytes/1024/1024/1024
but when it sends me an email, the results are not correct. I can click the link to "view in splunk", and at that point the time range is set as "date time range", and not as "today".
How can i set this to always be "today" in my search/alert?
What makes you think it is incorrect? Did you look at the actual values in the timepicker? If you do, and you correctly set the search to run for
today (you have not shared those details), then you will find that the
latest values inside of
Date & Time Range correspond to
today for the user that ran the search (the one who owns the saved search), which may or may not be you. It is confusing because it doesn't say
today and there is nothing that can be done about that.
the results in my email come incorrect. I can see this difference when i view the license tab in splunk, on the admin gui.
I found that in my actual search that is being used for the alert i can specify.