Forum Discussion
Bug: Custom Date Searches v 30d option
We are getting vastly different results depending on how we search Incidents using Lighthouse Multi-Tenant View. Scenario: A) Set filters to pre-built 30d search, filter the workspace we are worki...
This may be a option (if not can you share your query example), did you do this?
| where TimeGenerated > ago(30d)
Then it will run from the time you press return (so maybe 10:04 - my current time). If you need a whole day, then try this, which is from midnight 30days ago.
| where TimeGenerated > startofday(ago(30d))
You may want to combine this with a between to capture. This reminds me I have prepared a Blog on this topic, which I need to finish! There is an endofday option as well..