is there a possibility to calculate with an time modifier that represents the beginning of "today"?
I would like to use this kind of modifier like the "now()" function. So the result of the "today" modifier would be 1385337600 as timestamp when i use it right now.
You can use
earliest=@d latest=now in your search mean starting the beginning of the day till now.
Hope that this will help
What about this:
...| eval today = strptime(strftime(now(),"%m/%d/%y"),"%m/%d/%y")
Get now epoch, then strip the hour, parse it, and then you get the epoch for today