I have a requirement that I need to monitor Splunk license, I'm calculating the size of index for the day, here i need to give the earliest time = 12 AM How should i give this??
12AM as in midnight early today?
Try @d - skips to start of day. -5d@d for midnight five days ago... and so on.
View solution in original post