topic Re: Between dates condition in Dashboards & Visualizations

Between dates condition showing error?

Neel88 — Fri, 03 Feb 2023 16:04:50 GMT

Hello everyone,

I am passing the dates as token but it shows the error in both the condition.

Cond1: | where (Date>="$date_start$" AND Date<="$date_end$")

Cond2: | where (Date>="2022-06-01" AND Date<="2022-06-02")

Please help

Re: Between dates condition

gcusello — Fri, 03 Feb 2023 11:48:01 GMT

Hi @Neel88,

to compare dates, you have to transform them in epochtime using the strptime function, you cannot compare dates in text format.

The only apparent exception is _time, but it's only apparence because it's already in epochtime.

something like this:

<your_search> | eval date_start=strptime($date_start$,"%Y-%m-%d"), date_end=strptime($date_end$,"%Y-%m-%d"), Date=strptime(date,"%Y-%m-%d") | where Date>=date_start AND Date<=date_end | ...

Ciao.

Giuseppe

Re: Between dates condition

Neel88 — Fri, 03 Feb 2023 12:19:36 GMT

Hi,

Thank you for your response.

I have tried and getting this error.

Re: Between dates condition

gcusello — Fri, 03 Feb 2023 13:05:44 GMT

Hi @Neel88,

this is a different problem:

in the simple xml dashboards you cannout use "<" or ">" but you have to use: "<" and ">"

Ciao.

Giuseppe

Re: Between dates condition

Neel88 — Fri, 03 Feb 2023 14:02:16 GMT

Thank you for your response.

| where (Date = ">","$date_start$") AND (Date = "<","$date_end$")

I am very new with this tool. I am not getting result.

Re: Between dates condition

gcusello — Fri, 03 Feb 2023 14:06:21 GMT

Hi @Neel88,

I used quotes to delimit the strings, use them without quotes:

<your_search> | eval date_start=strptime($date_start$,"%Y-%m-%d"), date_end=strptime($date_end$,"%Y-%m-%d"), Date=strptime(date,"%Y-%m-%d") | where Date>=date_start AND Date<=date_end | ...

Ciao.

Giuseppe

Re: Between dates condition

Neel88 — Fri, 03 Feb 2023 14:33:57 GMT

Thank you so much!! Its working fine 🙂