events since a certain time (1700) in the previous business day

[owainmcguire]

We have a deadline on a business day after which we cannot place orders (events). This is 1700 hrs.

I would like to pick up certain events from this deadline until now. So similar to 10PM last night from the documentation.

@d-2h Snap to the beginning of today (12AM) and subtract 2 hours from that time. 10PM last night.

@d-7h would will not pick up the new value after now is 1700 hrs. At 1701 it should be searching from 1700 today and not 1700 the previous business day.

[araitz]

I would advise using the date_* metadata, should make your life a lot easier.

index=_internal earliest=-1d@d [ | stats count | eval date_mday=strftime(now(), "%d") | fields date_mday] OR date_hour >16

The subsearch gets today's date_mday value, and the OR will include stuff from yesterday from 17:00 on.

[wpreston]

See this question. The answer from lguinn should account for what you need.

[twinspop]

Maybe I'm reading too much into his question, but i don't think that solves his problem. He wants to return any results after 17:00 yesterday until the present (or any specific time)... unless the search is run 17:00-23:59:59 today. In that case, return today's results from after 17:00.

[twinspop]

That's trickier than it seems at first glance. This is my first run at it. Hopefully there's a more elegant solution.

earliest=@d-7h latest=@d+17h | eval newday=0 | append [search 
earliest=@d+17h latest=+1d@d | eval newday=1 ] | 
eventstats latest(newday) as newdaytest | 
table _time field field1 field2 fieldN newday newdaytest | 
where newday=newdaytest

So run 2 searches. One has the time from 17h last night to 17h today. The other is 17h today to midight. Eval a new field in each search so we can ID which results belong to which. Then compare the latest returned result's ID. Return only those results that have the same.