Hi everyone, I'm new to SWQL here so please bear with me. Trying to return all syslogs from 'yesterday', as in the prior calendar day. Found a thread that covers this but the query doesn't work when I apply it to the syslog message table.
I can get other WHERE statements to work that reference the date/time as seen below. However that just gets me the past 24 hours.
SELECT Message
,MessageDateTime
FROM Orion.OLM.LogEntry
--This works:
WHERE MessageDateTime > AddDay(-1,(GETUTCDATE()))
This statement does not work when selecting from the syslog table but does work using the entire script copy pasted from the original thread.
SELECT Message
,MessageDateTime
FROM Orion.OLM.LogEntry
--This does not work:
WHERE MessageDateTime BETWEEN DATETRUNC('day', GETUTCDATE() - 1) AND DATETRUNC('day', GETUTCDATE())

Any ideas?