search in saved search result

[ryastrebov]

Hello!
I have saved search for 8 days. I need upload search result to csv-file for several days. One day - one csv. I use loadjob command for get result of my savedsearch and I select a time interval of 1 day. But I get all result from my savedsearch. Why? How do I select the results of the data for each day?

[jonuwz · Accepted solution]

Because when you use a timerangepicker, it tells the indexers what timerange to grab off the disks.

When you do a loadjob, it can't limit the search in that way, so all the data is returned.

If _time is saved in your saved search you can do something like :

... | where _time >= strptime("2013-01-30","%Y-%m-%d") AND _time < strptime("2013-01-31","%Y-%m-%d")

or, if you want to be relative ...

... | where _time >= relative_time(now(),"-3d@d")  AND _time < relative_time(now(),"-2d@d")

[ryastrebov]

Thank you!