Setting 'earliest' in a splunk query

[harihara]

index =prd-Thailand sourcetype=abc-app-log earliest=-75m@m latest=now

|table a, b,c ,d ,e, f
|where a=1324 b=345
|stats count as volume

Question is how to replace earliest=-1440m@m

Please let me know if any more details required

[harihara]

It is a dasboard query which is used linked other queries as well

[ITWhisperer]

Please provide further detail of what you have and what you are trying to achieve

[livehybrid]

Hi @harihara 

If you want to search back the last 24 hours then you can just replace the existing "-75m@m" with "-1440m@m", or "-1d" for the last 24 hours from now, or "-1d@m" which is the same as 1440 but just easier to read.

Are you having any issues when trying to replace the -75m@m  with "-1440m@m"?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing