Archive

In a alert I have to give earliest time as 12 Am , How do i write it as earliest=12 Am

New Member

I have a requirement that I need to monitor Splunk license, I'm calculating the size of index for the day, here i need to give the earliest time = 12 AM How should i give this??

Tags (1)
0 Karma
Highlighted

Re: In a alert I have to give earliest time as 12 Am , How do i write it as earliest=12 Am

SplunkTrust
SplunkTrust

12AM as in midnight early today?

Try @d - skips to start of day. -5d@d for midnight five days ago... and so on.

View solution in original post

0 Karma
Highlighted

Re: In a alert I have to give earliest time as 12 Am , How do i write it as earliest=12 Am

New Member

Thanks Martin

0 Karma