Search previous day, not last 24 hours

Graylog Central (peer support)
1

Hi,

I’d like to be able to search ‘yesterday’ or the previous day, and have it search from 0:00 to 24:00 from the previous day. The last 24 hours aren’t helpful for me, because depending on when I’m searching I’m getting a lot of current day data or overnight data.

I can do an absolute search, but I’d like a dashboard widget that could show me stats from ‘yesterday’. Same for last month. Is there a way to do the previous month day 1 to 31, rather than search the last 30 days.

Is this possible?

2

Hi,

have a look at searching based on keyword. you could use for example:
“yesterday midnight to today midnight”
to shift the time a bit you could use:
“yesterday midnight +0200 to today midnight +0200”

for more advanced time frame definitions read natty

Have a try and leave a comment
Thomas