Splunk Search

Error in 'where' command: The operator at '>=2101 and week<=2152' is invalid.

deruvara
Explorer

Hi I am trying to filter data using week data using 2 dropdowns. Please find info below snippet. the below code throws an error " Error in 'where' command: The operator at '>=2101 and week<=2152' is invalid." pLease suggest.

input type is dropdown and Dropdown menu for starting week :
token is "from_week_token"
label is "From week"
fieldForLabel is "week"
fieldForValue is "week"
default is "2101"
query is
source="pdfthroughput_pdf_patches.json" host="LT433534" index="pdf_patches" sourcetype="_json"|eval weekNday=split(planned_stopped_on,".") | eval week=mvindex(weekNday,0) | table week | dedup week | where week>=2101 and week<=2152

input type is dropdown and dropdown menu for end week:
token is "to_week_token"
label is "To week"
default is "2152"
fieldForLabel is "week"
fieldForValue is "week"
query:
source="pdfthroughput_pdf_patches.json" host="LT433534" index="pdf_patches" sourcetype="_json"|eval weekNday=split(planned_stopped_on,".") | eval week=mvindex(weekNday,0) | table week | dedup week | where week>=2101 and week<=2152

Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

If your search string contains HTML escape code '&gt;' and '&lt;' when it should be '>' and '<', SPL will not accept them.   Try 

source="pdfthroughput_pdf_patches.json" host="LT433534" index="pdf_patches" sourcetype="_json"|eval weekNday=split(planned_stopped_on,".") | eval week=mvindex(weekNday,0) | table week | dedup week | where week>=2101 and week<=2152

(In Simple XML dashboard source view escape codes do go into search portion.  But if you edit search in UI, you'll see that they are all converted to their rendered symbols.)

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

If your search string contains HTML escape code '&gt;' and '&lt;' when it should be '>' and '<', SPL will not accept them.   Try 

source="pdfthroughput_pdf_patches.json" host="LT433534" index="pdf_patches" sourcetype="_json"|eval weekNday=split(planned_stopped_on,".") | eval week=mvindex(weekNday,0) | table week | dedup week | where week>=2101 and week<=2152

(In Simple XML dashboard source view escape codes do go into search portion.  But if you edit search in UI, you'll see that they are all converted to their rendered symbols.)

PickleRick
SplunkTrust
SplunkTrust

Try converting week to number() since it's probably treated as string

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...