I have this search query sourcetype="CurrentWeatherSGMap" Message="Yishun" | eval Description=case(current_summary="Rain", "Poor",current_summary="Thundery Showers","Poor", current_summary="Cloudy", "Fair", current_summary="Partly Cloudy", "Excellent") | chart dc(Description) over _time by Description | eval Poor=if(Description==Poor, "1", "1"). How can I set the chart to display from 12am to 12am time range daily ?
Or can I use advanced xml to display my result ?
Hi,
I would suggest using the following in your search.
earliest=@d latest=@d+12
let me know if that works for you.
Regards,
Amit Saxena
Hi,
I would suggest using the following in your search.
earliest=@d latest=@d+12
let me know if that works for you.
Regards,
Amit Saxena
Hi,
Do confirm it the above solution worked for you ?
Regards,
Amit Saxena
You can explicitly define earlest=-1d@d latest=0d@d if only the previous day's data is to be displayed.