Dashboards & Visualizations

Between dates condition showing error?

Neel88
Explorer

Hello everyone,

 

I am passing the dates as token but it shows the error in both the condition.

Cond1: | where (Date>="$date_start$" AND Date<="$date_end$")

Cond2: | where (Date>="2022-06-01" AND Date<="2022-06-02")

Please help

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Neel88,

to compare dates, you have to transform them in epochtime using the strptime function, you cannot compare dates in text format.

The only apparent exception is _time, but it's only apparence because it's already in epochtime.

something like this:

<your_search>
| eval date_start=strptime($date_start$,"%Y-%m-%d"), date_end=strptime($date_end$,"%Y-%m-%d"), Date=strptime(date,"%Y-%m-%d")
| where Date>=date_start AND Date<=date_end
| ...

Ciao.

Giuseppe

Neel88
Explorer

Hi,

Thank you for your response. 

I have tried and getting this error.

Neel88_1-1675426768151.png

 

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Neel88,

this is a different problem:

in the simple xml dashboards you cannout use "<" or ">" but you have to use: "&lt;" and "&gt;"

Ciao.

Giuseppe

Neel88
Explorer

Thank you for your response.

 

| where (Date = "&gt;","$date_start$") AND (Date = "&lt;","$date_end$")

 

I am very new with this tool. I am not getting result.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Neel88,

I used quotes to delimit the strings, use them without quotes:

<your_search>
| eval date_start=strptime($date_start$,"%Y-%m-%d"), date_end=strptime($date_end$,"%Y-%m-%d"), Date=strptime(date,"%Y-%m-%d")
| where Date&gt;=date_start AND Date&lt;=date_end
| ...

Ciao.

Giuseppe

Neel88
Explorer

Thank you so much!! Its working fine 🙂 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...