https://community.splunk.com/t5/Splunk-Dev/Help-with-Event-Search-based-on-custom-time-field/m-p/599433#M10636 <P>i found for below query&nbsp; the search is happening based on default time field which is&nbsp; _time&nbsp; , so when ever i am choosing the date and time based on default time which is '<SPAN>5/26/22&nbsp;</SPAN><SPAN>7:40:00.000 AM</SPAN>' then the events are populating but if i am selecting any date and time which is align with my custom time field which is 'originaltime'&nbsp; then i am not getting any event , am i doing any thing wrong here<BR /><BR /></P> <LI-CODE lang="markup">index="summary_carrier_service" originalsource="*gps-request-processor-dev*" originalsourcetype= "*eu-central-1*" event="*Request" | fields event category labelType documentType regenerate businessKey businessValue sourceNodeType sourceNodeCode geoCode jobId status sourcetype source originaltime | addinfo | eval ts=strptime(originaltime,"%Y-%m-%d %H:%M:%S") | where (ts&gt;info_min_time and ts&lt;=info_max_time)</LI-CODE> <P><BR /><BR /><BR /></P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="csahoo_0-1653569210765.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/19837iC3C91C1A05FD551C/image-size/large?v=v2&amp;px=999" role="button" title="csahoo_0-1653569210765.png" alt="csahoo_0-1653569210765.png" /></span></P> <P>&nbsp;</P> <P><BR /><BR /><BR /><BR /></P> Thu, 26 May 2022 15:14:25 GMT csahoo 2022-05-26T15:14:25Z https://community.splunk.com/t5/Splunk-Dev/Help-with-Event-Search-based-on-custom-time-field/m-p/599433#M10636 <P>i found for below query&nbsp; the search is happening based on default time field which is&nbsp; _time&nbsp; , so when ever i am choosing the date and time based on default time which is '<SPAN>5/26/22&nbsp;</SPAN><SPAN>7:40:00.000 AM</SPAN>' then the events are populating but if i am selecting any date and time which is align with my custom time field which is 'originaltime'&nbsp; then i am not getting any event , am i doing any thing wrong here<BR /><BR /></P> <LI-CODE lang="markup">index="summary_carrier_service" originalsource="*gps-request-processor-dev*" originalsourcetype= "*eu-central-1*" event="*Request" | fields event category labelType documentType regenerate businessKey businessValue sourceNodeType sourceNodeCode geoCode jobId status sourcetype source originaltime | addinfo | eval ts=strptime(originaltime,"%Y-%m-%d %H:%M:%S") | where (ts&gt;info_min_time and ts&lt;=info_max_time)</LI-CODE> <P><BR /><BR /><BR /></P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="csahoo_0-1653569210765.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/19837iC3C91C1A05FD551C/image-size/large?v=v2&amp;px=999" role="button" title="csahoo_0-1653569210765.png" alt="csahoo_0-1653569210765.png" /></span></P> <P>&nbsp;</P> <P><BR /><BR /><BR /><BR /></P> Thu, 26 May 2022 15:14:25 GMT https://community.splunk.com/t5/Splunk-Dev/Help-with-Event-Search-based-on-custom-time-field/m-p/599433#M10636 csahoo 2022-05-26T15:14:25Z https://community.splunk.com/t5/Splunk-Dev/Help-with-Event-Search-based-on-custom-time-field/m-p/599447#M10637 <P>The <FONT face="courier new,courier">AND</FONT> operator in the <FONT face="courier new,courier">where</FONT> command must be in upper case.</P><P>If you still don't get results, use the <FONT face="courier new,courier">table</FONT> command to examine the ts, info_min_time, and info_max_time fields.</P> Thu, 26 May 2022 14:14:10 GMT https://community.splunk.com/t5/Splunk-Dev/Help-with-Event-Search-based-on-custom-time-field/m-p/599447#M10637 richgalloway 2022-05-26T14:14:10Z