Hello,
i am trying to search for field values in intervall (79,90).
Both versions do not work properly as i know what to expect.
v1
index=XXX earliest="08/03/2020:15:00:00" latest="08/03/2020:16:30:00" TEMP<90 TEMP>79
| stats count as Counter
v2
index=XXX earliest="08/03/2020:15:00:00" latest="08/03/2020:16:30:00" TEMP<90 AND TEMP>79
| stats count as Counter
is TEMP field ?
I have tried below and working fine.
index=_internal earliest="09/14/2020:11:00:00" latest="09/14/2020:13:00:00" date_hour>11 date_hour<13
is TEMP field ?
I have tried below and working fine.
index=_internal earliest="09/14/2020:11:00:00" latest="09/14/2020:13:00:00" date_hour>11 date_hour<13
Yeah it works fine. Turns out what i expected to expect was not what i should have expected 🙂 Sry
Your date time format seems a little different, usually there is a space between the date and the time not a colon. Do you have some sample data events you could share?
earliest and latest time format will have column in between date & time.
Yes I just checked _internal - still would be useful to have some sample data though