Earliest is inclusive, latest is exclusive. In math terms, [earliest, latest) . It has to be one of each, else events would be missed or doubled if you schedule a search over an hour time range every hour. Logically, -d@d to @d then gives you "everything with a date of yesterday and any time" - sounds very sane to me. The docs aren't very explicit on that, the bottom example backs this up here though: http://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Specifytimemodifiersinyoursearch#Examples_of_searches_with_relative_time_modifiers ... View more