Hello
I have a few scheduled API calls that feed into my SIEM, At the moment mostly daily.
To avoid feeding in duplicate date each day I have been trying to figure out how to filter the query results relative to the time the query is run.
The goal is to run something similar to this:
WHERE unix_time >= now() - 1dayor
WHERE epoch >= now() - 1day
I've tried following a few different examples I've found online but whenever I try using any of the date/time functions (DATEDIFF, DATEADD, DATESUB, etc) or try converting now() to an epoch (CAST, CONVERT, etc) I get:
"Get result failed error code: 400, message: Failed to get QueryResults Bad Request"
Anyone have any ideas?
