topic How to find events between date ranges? in Splunk Search

How to find events between date ranges?

jimbolya11 — Thu, 05 Apr 2018 13:24:55 GMT

This has been answered but using the methods still do not provide the right results.
I have a date column. Format is like 4/2/2018.
I need to be able to find the events between date ranges. I've tried the conversion methods posted in answers, but when I do a WHERE Date>="4/2/2018" AND Date<="4/10/2018" the results pull a huge range of dates within 4/2018.

Cheers ~

Re: How to find events between date ranges?

richgalloway — Thu, 05 Apr 2018 15:52:59 GMT

Dates cannot be compared as strings. You must convert them to integer (epoch) form for proper comparison. Try this in your query:

... | where (strptime(Date, "%m/%d/%Y")>=strptime("4/2/2018", "%m/%d/%Y")) AND (strptime(Date, "%m/%d/%Y")>=strptime("4/10/2018", "%m/%d/%Y")) | ...

Re: How to find events between date ranges?

jconger — Thu, 05 Apr 2018 16:07:08 GMT

For Date conversion, see this -> https://answers.splunk.com/answers/638427/convert-string-to-date-1.html

Your WHERE command is comparing a timestamp to a string. You'll need to convert the string to a timestamp. Here is an example:

| makeresults 
| eval Date="4/2/2018" 
| eval timestampDate=strptime(Date, "%m/%d/%Y") 
| eval timestampStart=strptime("4/2/2018", "%m/%d/%Y") 
| eval timestampEnd=strptime("4/10/2018", "%m/%d/%Y") 
| eval formattedTimestamp = strftime(timestamp,"%Y-%m-%dT%H:%M:%S") 
| where timestampDate >= timestampStart AND timestampDate <= timestampEnd