Solved: data query

DTERM · ‎05-19-2011

index="named" 'earliest="@d-1h latest=@d+11'"

I'm trying to get all events that happened yesterday between 11 AM and 11 PM using the above search. It does not return any responses. What is it missing?

TIA

zsimic · ‎05-19-2011

Looks like your quotes are wrong, and didn't specify earlest/latest correctly try this:

index="named" earliest=@d-13h latest=@d-1h

Or, if you prefer to have quotes everywhere:

index="named" earliest="@d-13h" latest="@d-1h"

If you meant "between yesterday 11 PM and today 11 AM", then try this (same as yours, just quotes corrected):

index="main" earliest="@d-1h" latest="@d+11h"

Hope this helps 🙂

View solution in original post

zsimic · ‎05-19-2011

Looks like your quotes are wrong, and didn't specify earlest/latest correctly try this:

index="named" earliest=@d-13h latest=@d-1h

Or, if you prefer to have quotes everywhere:

index="named" earliest="@d-13h" latest="@d-1h"

If you meant "between yesterday 11 PM and today 11 AM", then try this (same as yours, just quotes corrected):

index="main" earliest="@d-1h" latest="@d+11h"

Hope this helps 🙂

data query

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose

Manage Edge Processor pipelines end to end with APIs

Join the Conversation