Splunk Search

data query

DTERM
Contributor

index="named" 'earliest="@d-1h latest=@d+11'"

I'm trying to get all events that happened yesterday between 11 AM and 11 PM using the above search. It does not return any responses. What is it missing?

TIA

Tags (1)
1 Solution

zsimic
Path Finder

Looks like your quotes are wrong, and didn't specify earlest/latest correctly try this:

index="named" earliest=@d-13h latest=@d-1h

Or, if you prefer to have quotes everywhere:

index="named" earliest="@d-13h" latest="@d-1h"

If you meant "between yesterday 11 PM and today 11 AM", then try this (same as yours, just quotes corrected):

index="main" earliest="@d-1h" latest="@d+11h"

Hope this helps 🙂

View solution in original post

zsimic
Path Finder

Looks like your quotes are wrong, and didn't specify earlest/latest correctly try this:

index="named" earliest=@d-13h latest=@d-1h

Or, if you prefer to have quotes everywhere:

index="named" earliest="@d-13h" latest="@d-1h"

If you meant "between yesterday 11 PM and today 11 AM", then try this (same as yours, just quotes corrected):

index="main" earliest="@d-1h" latest="@d+11h"

Hope this helps 🙂

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...