index="named" 'earliest="@d-1h latest=@d+11'"
I'm trying to get all events that happened yesterday between 11 AM and 11 PM using the above search. It does not return any responses. What is it missing?
Looks like your quotes are wrong, and didn't specify earlest/latest correctly try this:
index="named" earliest=@d-13h latest=@d-1h
Or, if you prefer to have quotes everywhere:
index="named" earliest="@d-13h" latest="@d-1h"
If you meant "between yesterday 11 PM and today 11 AM", then try this (same as yours, just quotes corrected):
index="main" earliest="@d-1h" latest="@d+11h"
Hope this helps 🙂
View solution in original post