This seems like a simple proposition, yet I'm having a hard time finding date parameters to embed in my search to just get results for yesterday's 24 hour period.
Anyone have any insight?
Thank you,
Mike
Awesome - both of these solutions worked perfectly.
Thanks so much!
This works for me:
index=_internal earliest=-1d@d latest=-0d@d
You can select "Yesterday" in the time range picker, or set earliest=-d@d latest=@d
.