How to fetch last 24 hours data with query?

[tkadale]

Hi,

I want to fetch last 24 hours data.

Generally we can select time range with Time picker and graph will show the data according to selected Time. But this time i want to show table column with max power usage in last 24 hours for each host.

Thanks in advance

[geetanjali]

Thanks For quick response,

But my requirement is bit different.

I have one field "PowerUsage".

I want to display a table. first column in Host name, second is max of powerUsage by host. these two fields are OK. But i want third column as maximum powerUsage in last 24 hours.And "maximum power usage in last 24 hours" is not a field in log file. I need to extract the same for all hosts.

How to display these three columns in a single table.

Thanks in advance..

[geetanjali]

Thanks For quick response,
But my requirement is bit different.
I have one field "PowerUsage".
I want to display a table. first column in Host name, second is max of powerUsage by host. these two fields are OK. But i want third column as maximum powerUsage in last 24 hours.And "maximum power usage in last 24 hours" is not a field in log file. I need to extract the same for all hosts.
How to display these three columns in a single table.
Thanks in advance..

[sideview]

Well if there's a field called powerUsage in the raw events, and you want to draw a timechart split by host, it's just:

<search terms> | timechart max(powerUsage) by host

You can throw a 'span=1h' right after the timechart, but if you run that search over 24 hours I'm pretty sure timechart will automatically pick 1 hour buckets for you.

On the other hand, if you literally want to just show the max power usage for each host:

<search terms> | stats max(powerUsage) by host

However I wonder if there's some detail missing from your question.