Date

[Khuzair81]

I want to get the data only from yesterday Date is there anyway to write it in Query

Can i use  | where Date=-1d@d

I'm trying | eval today=strftime(now(), "%d")   | where Date=Today-1

[gcusello]

Hi @Khuzair81,

to take only the yesterday events, you have to add to your main search the time variables earliest and latest, something like this:

index=your_index earliest=-d@d latest=@d
| ...

Ciao.

Giuseppe

[Khuzair81]

Hi @gcusello there is field value in events like every day there are new events and some of them is updating from past few days so i just wanted the new events that came in yesterday. So i want to compare a field value with yesterday

[gcusello]

Hi @Khuzair81,

in this case you can use eval:

| eval yesterday_start=relative_time(now(),"-1d@d"), yesterday_end=yesterday_start+86400

in this way you have the time borders of yesterday (in epochtime) and you can transform your Date in epochtime and filter your events.

Ciao.

Giuseppe