Archive
Highlighted

In a alert I have to give earliest time as 12 Am , How do i write it as earliest=12 Am

New Member

I have a requirement that I need to monitor Splunk license, I'm calculating the size of index for the day, here i need to give the earliest time = 12 AM How should i give this??

Tags (1)
0 Karma
Highlighted

Re: In a alert I have to give earliest time as 12 Am , How do i write it as earliest=12 Am

SplunkTrust
SplunkTrust

12AM as in midnight early today?

Try @d - skips to start of day. -5d@d for midnight five days ago... and so on.

View solution in original post

0 Karma
Highlighted

Re: In a alert I have to give earliest time as 12 Am , How do i write it as earliest=12 Am

New Member

Thanks Martin

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.