what format should timestamp be in for starttime?

[HattrickNZ]

Regarding starttime from the docs

starttime starttime=<timestamp> Search from the specified date and time to the present (inclusive of the specified time).

What format should `` be in?

I have got this working starttime= 04/27/2015:00:00:00, that is mm/dd/yyyy, but I am seeing strange results, possibly duplicates in data. Can anyone advise?

For my reference this is in relation to this Q

[richgalloway]

starttime is deprecated and should be avoided. Use earliest, instead. That said, the timestamp format you used is correct. If you want to try a different format, use timeformat (another deprecated command).

I suggest you post a separate question with your search query and sample data so we can help resolve your "strange results".

[HattrickNZ]

I have done in the past and this was the solution then. Can I control earliest and latest date using fixed dates ? I will post it again, shall i?

[HattrickNZ]

posted a question here https://answers.splunk.com/answers/373591/can-i-control-earliest-and-latest-date-using-fixed-1.html