I have a requirement that I need to monitor Splunk license, I'm calculating the size of index for the day, here i need to give the earliest time = 12 AM How should i give this??
12AM as in midnight early today?
Try @d
- skips to start of day. -5d@d
for midnight five days ago... and so on.
12AM as in midnight early today?
Try @d
- skips to start of day. -5d@d
for midnight five days ago... and so on.
Thanks Martin