data query

[DTERM]

index="named" 'earliest="@d-1h latest=@d+11'"

I'm trying to get all events that happened yesterday between 11 AM and 11 PM using the above search. It does not return any responses. What is it missing?

TIA

[zsimic · Accepted solution]

Looks like your quotes are wrong, and didn't specify earlest/latest correctly try this:

index="named" earliest=@d-13h latest=@d-1h

Or, if you prefer to have quotes everywhere:

index="named" earliest="@d-13h" latest="@d-1h"

If you meant "between yesterday 11 PM and today 11 AM", then try this (same as yours, just quotes corrected):

index="main" earliest="@d-1h" latest="@d+11h"

Hope this helps 🙂