In a alert I have to give earliest time as 12 Am , How do i write it as earliest=12 Am

[ugramkonda]

I have a requirement that I need to monitor Splunk license, I'm calculating the size of index for the day, here i need to give the earliest time = 12 AM How should i give this??

[martin_mueller · Accepted solution]

12AM as in midnight early today?

Try @d - skips to start of day. -5d@d for midnight five days ago... and so on.

[ugramkonda]

Thanks Martin