I want to get the data only from yesterday Date is there anyway to write it in Query
Can i use | where Date=-1d@d
I'm trying | eval today=strftime(now(), "%d") | where Date=Today-1
Hi @Khuzair81,
to take only the yesterday events, you have to add to your main search the time variables earliest and latest, something like this:
index=your_index earliest=-d@d latest=@d
| ...
Ciao.
Giuseppe
Hi @gcusello there is field value in events like every day there are new events and some of them is updating from past few days so i just wanted the new events that came in yesterday. So i want to compare a field value with yesterday
Hi @Khuzair81,
in this case you can use eval:
| eval yesterday_start=relative_time(now(),"-1d@d"), yesterday_end=yesterday_start+86400
in this way you have the time borders of yesterday (in epochtime) and you can transform your Date in epochtime and filter your events.
Ciao.
Giuseppe