starttime from the docs
starttime=<timestamp> Search from the specified date and time to the present (inclusive of the specified time).
What format should `` be in?
I have got this working
starttime= 04/27/2015:00:00:00, that is mm/dd/yyyy, but I am seeing strange results, possibly duplicates in data. Can anyone advise?
For my reference this is in relation to this Q
starttime is deprecated and should be avoided. Use
earliest, instead. That said, the timestamp format you used is correct. If you want to try a different format, use
timeformat (another deprecated command).
I suggest you post a separate question with your search query and sample data so we can help resolve your "strange results".