cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 12

Need Help modifying a SWQL Query (date/time)

I have a report the list events for the past 24 hours.  I now need that same report for just yesterday.

SELECT
et.Name
, ToLocal(e.EventTime) as EventTime
, e.EventType
, e.Message
, e.InstanceSiteId
FROM Orion.Events AS e
INNER JOIN Orion.EventTypes AS et ON et.EventType = e.EventType AND et.InstanceSiteId = e.InstanceSiteId
WHERE e.message LIKE 'ORION ALERT:%'
and e.EventTime > AddDate('day', -1, GETDATE())
ORDER BY e.EventTime DESC
WITH NOLOCK

 

This returns the " Event ORION ALERTS:" for the past 24 hours.

I want the events for yesterday

Thank you

 

0 Kudos
2 Replies

and e.EventTime < DATETRUNC('day',GETUTCDATE())
and e.EventTime > addday(-1,DATETRUNC('day',GETUTCDATE()))

might have to fuss around with the tolocals depending on how you want to deal with that in your scenario.
- Marc Netterfield, Github
0 Kudos

Thanks I'll spend some time with this at the weekend.

 

0 Kudos