Why is our Splunk alert not showing results for "today"?

[agentguerry]

I have set this alert up, which i want to show me the results of "today"

index=_internal source="*license_usage.lo*" type=Usage pool="Linux Pool"| stats sum(b) as bytes | eval gb=bytes/1024/1024/1024

but when it sends me an email, the results are not correct. I can click the link to "view in splunk", and at that point the time range is set as "date time range", and not as "today".

How can i set this to always be "today" in my search/alert?

Thanks!

[woodcock]

What makes you think it is incorrect? Did you look at the actual values in the timepicker? If you do, and you correctly set the search to run for today (you have not shared those details), then you will find that the earliest and latest values inside of Date & Time Range correspond to today for the user that ran the search (the one who owns the saved search), which may or may not be you. It is confusing because it doesn't say today and there is nothing that can be done about that.

[agentguerry]

the results in my email come incorrect. I can see this difference when i view the license tab in splunk, on the admin gui.

I found that in my actual search that is being used for the alert i can specify.

"earliest=@d|"

[woodcock]

What are the time parameters in your saved search?