Splunk Search

Error in 'where' command: The operator at '>=2101 and week<=2152' is invalid.

deruvara
Explorer

Hi I am trying to filter data using week data using 2 dropdowns. Please find info below snippet. the below code throws an error " Error in 'where' command: The operator at '>=2101 and week<=2152' is invalid." pLease suggest.

input type is dropdown and Dropdown menu for starting week :
token is "from_week_token"
label is "From week"
fieldForLabel is "week"
fieldForValue is "week"
default is "2101"
query is
source="pdfthroughput_pdf_patches.json" host="LT433534" index="pdf_patches" sourcetype="_json"|eval weekNday=split(planned_stopped_on,".") | eval week=mvindex(weekNday,0) | table week | dedup week | where week>=2101 and week<=2152

input type is dropdown and dropdown menu for end week:
token is "to_week_token"
label is "To week"
default is "2152"
fieldForLabel is "week"
fieldForValue is "week"
query:
source="pdfthroughput_pdf_patches.json" host="LT433534" index="pdf_patches" sourcetype="_json"|eval weekNday=split(planned_stopped_on,".") | eval week=mvindex(weekNday,0) | table week | dedup week | where week>=2101 and week<=2152

Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

If your search string contains HTML escape code '&gt;' and '&lt;' when it should be '>' and '<', SPL will not accept them.   Try 

source="pdfthroughput_pdf_patches.json" host="LT433534" index="pdf_patches" sourcetype="_json"|eval weekNday=split(planned_stopped_on,".") | eval week=mvindex(weekNday,0) | table week | dedup week | where week>=2101 and week<=2152

(In Simple XML dashboard source view escape codes do go into search portion.  But if you edit search in UI, you'll see that they are all converted to their rendered symbols.)

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

If your search string contains HTML escape code '&gt;' and '&lt;' when it should be '>' and '<', SPL will not accept them.   Try 

source="pdfthroughput_pdf_patches.json" host="LT433534" index="pdf_patches" sourcetype="_json"|eval weekNday=split(planned_stopped_on,".") | eval week=mvindex(weekNday,0) | table week | dedup week | where week>=2101 and week<=2152

(In Simple XML dashboard source view escape codes do go into search portion.  But if you edit search in UI, you'll see that they are all converted to their rendered symbols.)

PickleRick
SplunkTrust
SplunkTrust

Try converting week to number() since it's probably treated as string

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...