Real-time search with fixed start

[marksnelling]

I'd like to create a real-time search and chart plotting logged values since midnight. My search is below.
eventtype="val_update" | rex "(?i) val=(?P<pnl>.+)" | timechart latest(val) span=3m

When setting the search window how can I use the rt value for the latest time with something like @d for the earliest time?

[marksnelling · Accepted solution]

Actually rt-0@d seems to do what I want

[Drainy]

To do a realtime backfill with a snap to day you just use earliest as rt-d@d and latest as rt

[Drainy]

Sorry, its rt-d@d, typo in my answer 🙂

[marksnelling]

If I understand this correctly, I should use rt-@d in the Earliest field in the search Custom Time range? If I do this Splunk complains it's an invalid time string.