topic Re: Date in Getting Data In

Date

Khuzair81 — Tue, 08 Jun 2021 09:26:27 GMT

I want to get the data only from yesterday Date is there anyway to write it in Query

Can i use | where Date=-1d@d

I'm trying | eval today=strftime(now(), "%d") | where Date=Today-1

Re: Date

gcusello — Tue, 08 Jun 2021 09:30:01 GMT

to take only the yesterday events, you have to add to your main search the time variables earliest and latest, something like this:

index=your_index earliest=-d@d latest=@d | ...

Ciao.

Giuseppe

Re: Date

Khuzair81 — Tue, 08 Jun 2021 09:47:01 GMT

Hi @gcusello there is field value in events like every day there are new events and some of them is updating from past few days so i just wanted the new events that came in yesterday. So i want to compare a field value with yesterday

Re: Date

gcusello — Tue, 08 Jun 2021 09:52:25 GMT

Hi @Khuzair81,

in this case you can use eval:

| eval yesterday_start=relative_time(now(),"-1d@d"), yesterday_end=yesterday_start+86400

in this way you have the time borders of yesterday (in epochtime) and you can transform your Date in epochtime and filter your events.

Ciao.

Giuseppe