Splunk Search

Error in 'where' command: The operator at '>=2101 and week<=2152' is invalid.

deruvara
Explorer

Hi I am trying to filter data using week data using 2 dropdowns. Please find info below snippet. the below code throws an error " Error in 'where' command: The operator at '>=2101 and week<=2152' is invalid." pLease suggest.

input type is dropdown and Dropdown menu for starting week :
token is "from_week_token"
label is "From week"
fieldForLabel is "week"
fieldForValue is "week"
default is "2101"
query is
source="pdfthroughput_pdf_patches.json" host="LT433534" index="pdf_patches" sourcetype="_json"|eval weekNday=split(planned_stopped_on,".") | eval week=mvindex(weekNday,0) | table week | dedup week | where week>=2101 and week<=2152

input type is dropdown and dropdown menu for end week:
token is "to_week_token"
label is "To week"
default is "2152"
fieldForLabel is "week"
fieldForValue is "week"
query:
source="pdfthroughput_pdf_patches.json" host="LT433534" index="pdf_patches" sourcetype="_json"|eval weekNday=split(planned_stopped_on,".") | eval week=mvindex(weekNday,0) | table week | dedup week | where week>=2101 and week<=2152

Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

If your search string contains HTML escape code '&gt;' and '&lt;' when it should be '>' and '<', SPL will not accept them.   Try 

source="pdfthroughput_pdf_patches.json" host="LT433534" index="pdf_patches" sourcetype="_json"|eval weekNday=split(planned_stopped_on,".") | eval week=mvindex(weekNday,0) | table week | dedup week | where week>=2101 and week<=2152

(In Simple XML dashboard source view escape codes do go into search portion.  But if you edit search in UI, you'll see that they are all converted to their rendered symbols.)

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

If your search string contains HTML escape code '&gt;' and '&lt;' when it should be '>' and '<', SPL will not accept them.   Try 

source="pdfthroughput_pdf_patches.json" host="LT433534" index="pdf_patches" sourcetype="_json"|eval weekNday=split(planned_stopped_on,".") | eval week=mvindex(weekNday,0) | table week | dedup week | where week>=2101 and week<=2152

(In Simple XML dashboard source view escape codes do go into search portion.  But if you edit search in UI, you'll see that they are all converted to their rendered symbols.)

PickleRick
SplunkTrust
SplunkTrust

Try converting week to number() since it's probably treated as string

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...