Splunk Search

data query

Contributor

index="named" 'earliest="@d-1h latest=@d+11'"

I'm trying to get all events that happened yesterday between 11 AM and 11 PM using the above search. It does not return any responses. What is it missing?

TIA

Tags (1)
1 Solution

Path Finder

Looks like your quotes are wrong, and didn't specify earlest/latest correctly try this:

index="named" earliest=@d-13h latest=@d-1h

Or, if you prefer to have quotes everywhere:

index="named" earliest="@d-13h" latest="@d-1h"

If you meant "between yesterday 11 PM and today 11 AM", then try this (same as yours, just quotes corrected):

index="main" earliest="@d-1h" latest="@d+11h"

Hope this helps 🙂

View solution in original post

Path Finder

Looks like your quotes are wrong, and didn't specify earlest/latest correctly try this:

index="named" earliest=@d-13h latest=@d-1h

Or, if you prefer to have quotes everywhere:

index="named" earliest="@d-13h" latest="@d-1h"

If you meant "between yesterday 11 PM and today 11 AM", then try this (same as yours, just quotes corrected):

index="main" earliest="@d-1h" latest="@d+11h"

Hope this helps 🙂

View solution in original post