Need Help modifying a SWQL Query (date/time)

saw10

I have a report the list events for the past 24 hours.  I now need that same report for just yesterday.

SELECT
et.Name
, ToLocal(e.EventTime) as EventTime
, e.EventType
, e.Message
, e.InstanceSiteId
FROM Orion.Events AS e
INNER JOIN Orion.EventTypes AS et ON et.EventType = e.EventType AND et.InstanceSiteId = e.InstanceSiteId
WHERE e.message LIKE 'ORION ALERT:%'
and e.EventTime > AddDate('day', -1, GETDATE())
ORDER BY e.EventTime DESC
WITH NOLOCK

This returns the " Event ORION ALERTS:" for the past 24 hours.

I want the events for yesterday

Thank you

mesverrum

and e.EventTime < DATETRUNC('day',GETUTCDATE())
and e.EventTime > addday(-1,DATETRUNC('day',GETUTCDATE()))

might have to fuss around with the tolocals depending on how you want to deal with that in your scenario.