How can I achieve the query for retrieving data for a particular time for the last 6 days? Suppose I want to get the data for last 6 days from time 12.00 A.M to 4.00 P.M. Please help on the same
Hi @Subarna,
you have to run a search for the full period adding a filter on the hosu, something like this:
index=your_index earliest=-6d@d latest=@d (date_hour>11 date_hour<17)
| ...
if you haven't date _hour, you have to extract it:
index=your_index earliest=-6d@d latest=@d
| eval date_hour=strftime(_time,"%H")
| where date_hour>11 AND date_hour<17
| ...
Ciao.
Giuseppe