How do I get the 1st day on the current year ?

[Clovisa]

Hello, I would like to visualize data starting from the 1st of January of the current year.
I see how to get the current year, but how can we combine it with "1st of January" ?

index=main | eval year=strftime(now(),"%Y") 

[somesoni2]

Whats your report requirement and what's the query you're using?

[cmerriman · Accepted solution]

if you're looking to search for data year-to-date, use index=main earliest=@y

if you are looking to do year-roll-ups, you can do things like index=main|timechart span=1y count

you can format the time with |eval _time=strftime(relative_time(_time,"@y"),"%Y-%m-%d") to make all timestamps group to January 1 of that year in YYYY-mm-dd timestamp.

[Clovisa]

Thanks, the first option does exactly what I wanted !