Splunk Search

How do I get results for just yesterday?

MichaelCohen829
Explorer

This seems like a simple proposition, yet I'm having a hard time finding date parameters to embed in my search to just get results for yesterday's 24 hour period.

Anyone have any insight?

Thank you,

Mike

Tags (1)

MichaelCohen829
Explorer

Awesome - both of these solutions worked perfectly.

Thanks so much!

0 Karma

lukejadamec
Super Champion

This works for me:

index=_internal earliest=-1d@d latest=-0d@d

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can select "Yesterday" in the time range picker, or set earliest=-d@d latest=@d.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...