Help with search of evaluated field

[rodrigomarfei]

Hello,

I need a help with a search that seems very easy, but I'm unable to achieve the results I want.

The events are recieved in diferrent days, but no more than 3 days and the date is in the field event.Date.

The date format is "yyyy-mm-ddT00:00:00".

What I need is to search for all the events within the 3 days and then filter by the date.

So i've tried the following search:

index=something daysago=3
| eval dayOfSearch = strftime(relative(now(), "-2d@d"), "%Y-%m-%dT%H:%M:%S")
| search event.Date = dayOfSearch

It does not result to what I was expecting, but if I run the search replacing the variable dayOfsearch with the actual date, like "2021-09-05T00:00:00" it works.

What am I doing wrong or is that I better way to achieve this results?

Thank you!

[somesoni2 · Accepted solution]

Try something like this. Need to use "where" command if you're condition references other fields instead of static values. Also, since field name contains dot/special character, it needs to be enclosed in single quotes in where/eval.

index=something daysago=3
| eval dayOfSearch = strftime(relative(now(), "-2d@d"), "%Y-%m-%dT%H:%M:%S")
| where 'event.Date' = dayOfSearch

[rodrigomarfei]

That's it. Single quotes and where.

Thank you!

[ITWhisperer]

Try 

| where event.Date = dayOfSearch