https://community.splunk.com/t5/Splunk-Search/Search-improvement/m-p/560826#M159399 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/236119">@ibmbaranski</a>&nbsp;</P><P>You can filter events using earliest and latest filter. Can you please try this?</P><LI-CODE lang="markup">index=xyz sourcetype=abc NOT user_email=unauthenticated (user_email=*) [| makeresults | eval earliest=strptime("20210723", "%Y%m%d"),latest=relative_time(earliest, "+1d@d") | table earliest latest | format] | ...</LI-CODE><P>&nbsp;</P><P>KV&nbsp;</P> Mon, 26 Jul 2021 16:05:58 GMT kamlesh_vaghela 2021-07-26T16:05:58Z https://community.splunk.com/t5/Splunk-Search/Search-improvement/m-p/560819#M159398 <P>Hi - looking for a more efficient way to do this, if anyone has any tips:</P><P>&nbsp;</P><P><STRONG><EM>index=xyz sourcetype=abc NOT user_email=unauthenticated (user_email=*) | eval day=strftime(_time, "%Y%m%d") | search day=20210723 | ...</EM></STRONG></P><P>&nbsp;</P><P>Basically, can I filter on _time for a specific day without doing the eval then filter, this seems like an inefficient way to query if I can somehow say <EM><STRONG>dayOf(_time)='20201010'</STRONG></EM> or something like that...</P> Mon, 26 Jul 2021 15:33:52 GMT https://community.splunk.com/t5/Splunk-Search/Search-improvement/m-p/560819#M159398 ibmbaranski 2021-07-26T15:33:52Z https://community.splunk.com/t5/Splunk-Search/Search-improvement/m-p/560826#M159399 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/236119">@ibmbaranski</a>&nbsp;</P><P>You can filter events using earliest and latest filter. Can you please try this?</P><LI-CODE lang="markup">index=xyz sourcetype=abc NOT user_email=unauthenticated (user_email=*) [| makeresults | eval earliest=strptime("20210723", "%Y%m%d"),latest=relative_time(earliest, "+1d@d") | table earliest latest | format] | ...</LI-CODE><P>&nbsp;</P><P>KV&nbsp;</P> Mon, 26 Jul 2021 16:05:58 GMT https://community.splunk.com/t5/Splunk-Search/Search-improvement/m-p/560826#M159399 kamlesh_vaghela 2021-07-26T16:05:58Z