|
We have situations where we just want to show what happened "today", which is defined as from Midnight to now. That's easy to say in English, and it's easy to define latest=now, but I am having trouble figuring out what to specify as the 'earliest' value to get Splunk to understand midnight. |
One Answer:
|
Midnight is just zero hours, relative to the current day, so you can use: or just: You should also have |
