You can either use the timerange picker in the web GUI, or you can use time modifiers directly in your search, like this:
... earliest=-1d
http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/SearchTimeModifiers
Please read docs and apply a suitable one. This is no place where we solve all your problems for you, rather we help you solve problems.
I m on 5.0.3, Please provide suitable one, from your solution it is saying invalid earliest command