Splunk Search

Error in 'where' command: The operator at '>=2101 and week<=2152' is invalid.

deruvara
Explorer

Hi I am trying to filter data using week data using 2 dropdowns. Please find info below snippet. the below code throws an error " Error in 'where' command: The operator at '>=2101 and week<=2152' is invalid." pLease suggest.

input type is dropdown and Dropdown menu for starting week :
token is "from_week_token"
label is "From week"
fieldForLabel is "week"
fieldForValue is "week"
default is "2101"
query is
source="pdfthroughput_pdf_patches.json" host="LT433534" index="pdf_patches" sourcetype="_json"|eval weekNday=split(planned_stopped_on,".") | eval week=mvindex(weekNday,0) | table week | dedup week | where week>=2101 and week<=2152

input type is dropdown and dropdown menu for end week:
token is "to_week_token"
label is "To week"
default is "2152"
fieldForLabel is "week"
fieldForValue is "week"
query:
source="pdfthroughput_pdf_patches.json" host="LT433534" index="pdf_patches" sourcetype="_json"|eval weekNday=split(planned_stopped_on,".") | eval week=mvindex(weekNday,0) | table week | dedup week | where week>=2101 and week<=2152

Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

If your search string contains HTML escape code '&gt;' and '&lt;' when it should be '>' and '<', SPL will not accept them.   Try 

source="pdfthroughput_pdf_patches.json" host="LT433534" index="pdf_patches" sourcetype="_json"|eval weekNday=split(planned_stopped_on,".") | eval week=mvindex(weekNday,0) | table week | dedup week | where week>=2101 and week<=2152

(In Simple XML dashboard source view escape codes do go into search portion.  But if you edit search in UI, you'll see that they are all converted to their rendered symbols.)

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

If your search string contains HTML escape code '&gt;' and '&lt;' when it should be '>' and '<', SPL will not accept them.   Try 

source="pdfthroughput_pdf_patches.json" host="LT433534" index="pdf_patches" sourcetype="_json"|eval weekNday=split(planned_stopped_on,".") | eval week=mvindex(weekNday,0) | table week | dedup week | where week>=2101 and week<=2152

(In Simple XML dashboard source view escape codes do go into search portion.  But if you edit search in UI, you'll see that they are all converted to their rendered symbols.)

PickleRick
SplunkTrust
SplunkTrust

Try converting week to number() since it's probably treated as string

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...