Can we set a time range from today 00:00:00 AM to real time now?

[chrbar01]

Hello,

I would like to set a search for the 24H of the current day: a time range from today 00:00:00 AM to real time now?
Is it possible?
If yes, could you explain to me how to do that?

Thanks,
Chris

[somesoni2 · Accepted solution]

Use earliest=@d latest=now.

[cmerriman]

in the Advanced tab on the Time Range Picker, you could put "@d" in earliest and "now" in latest, would that work?

[chrbar01]

Thanks for your help 🙂

I'd like to set this range in real time.
I've found a solution with the values "rt-1@d" in earliest and "rt" in latest, inside the Advanced tab of the Time Range Picker.
It works, but if I enter the same value into the Search command line (earliest="rt-1@d" latest="rt"), I obtain the error: Invalid value "rt-1@d" for time term 'earliest'.
Do you know why?

[somesoni2]

The realtime time ranges are not designed to be applied inline in search. Read this for more details

https://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Specifyrealtimewindowsinyoursearch#Real-ti... (3rd para)

[chrbar01]

Ok, thanks a lot.