What does error earliest=-1d@d latest=-1h@h mean in Splunk, and how does "snapping" work?

Events containing "error" from yesterday at midnight until the start of the current hour: -1d@d means go back one day, then round down to the start of that day; -1h@h means go back one hour, then round down to the full hour.

* Go back, then round down: the window is whole days and hours, not rolling. *

Relative time modifiers have the form [+|-]<integer><unit>@<snap_unit>:

• Units: s seconds, m minutes, h hours, d days, w weeks, mon months, q quarters, y years. The integer defaults to 1, so m equals 1m.
• Snapping (@) rounds down to the start of the given unit. At 11:59, @h snaps to 11:00, not 12:00.
• Weekdays: @w0 snaps to Sunday, @w1 to Monday, and so on.

Worked example, if it is now 14:37 on Wednesday:

Snapping makes reports reproducible: "yesterday" means the whole calendar day regardless of when the search runs, instead of "the last 24 hours from right now".

Go deeper:

• Splunk — Specify time modifiers in your search — the full syntax, including snapping to weekdays.