How to filter the events by the date field?

[kiran331]

Hi

From the search, i get the event_date field. How can I filter the events by using the event_date field?

event_date
06/18/2014
06/20/2014
07/17/2014
...

I need the events only between 06/01/2014 - 06/31/2014. Any suggestions?

[richgalloway]

To compare dates you have to convert them into epoch form. Something like this

... | eval firstDate = strptime("06/01/2014", "%m/%d/%Y") | eval lastDate = strptime("06/30/2014", "%m/%d/%Y") | eval thisDate = strptime(event_date, "%m/%d/%Y") | where thisDate >= firstDate AND thisDate <= lastDate | ...