16 Nov 2023
01:21 PM
- last edited on
21 Nov 2023
11:03 AM
by
MaciejNeumann
I'm taking the liberty of sharing this tip because I've seen several people share difficulties in selecting a specific timeframe with the DQL, particularly when searching for information in the Logs.
Here are some examples to get around current limitations :
fetch logs,from:toTimestamp("T00:00:00")-1d
fetch logs,from:toTimestamp("T00:00:00")
fetch logs,from:toTimestamp("T00:00:00+2")
I hope this TIP can be useful to as many people as possible 🙂
Please let me know your comments.
16 Nov 2023 01:37 PM
Great😊 Thank you it's a very useful
12 Dec 2023 06:24 PM - edited 12 Dec 2023 06:41 PM
What is this "toTimestamp" function? I tried searching for it and, while I see it used in examples in their documentation, I don't see any explanation of what the function actually is, and my Google searches aren't producing results.
*EDIT* Ahh, found it. It's in their Conversion and Casting Functions section of their docs instead of in their Time functions section. They should maybe cross-reference those though, just to make finding it easier.
04 Mar 2024 12:56 PM
Hi all ,
Thanks for the tip here 😀
Do you have any other tip if we want to go through relative timeframe?
like if I want relative timings (like "now-1h/h to now-0h/h") or "from: now-1M/M to :now-0M/M" , I have the message "The parameter `from` has to be constant"
I have not found any tips to do so.
Temp solution I have found is to query larger data and then filter afterwards :
|filter getHour(timestamp) >= (getHour(now())-1) and getHour(timestamp) < getHour(now())
Is it possible to do it directly from timeframe filter ?
Best regards,
Christophe