Splunk Search

How to find events between date ranges?

jimbolya11
New Member

This has been answered but using the methods still do not provide the right results.
I have a date column. Format is like 4/2/2018.
I need to be able to find the events between date ranges. I've tried the conversion methods posted in answers, but when I do a WHERE Date>="4/2/2018" AND Date<="4/10/2018" the results pull a huge range of dates within 4/2018.

Cheers ~

0 Karma

jconger
Splunk Employee
Splunk Employee

For Date conversion, see this -> https://answers.splunk.com/answers/638427/convert-string-to-date-1.html

Your WHERE command is comparing a timestamp to a string. You'll need to convert the string to a timestamp. Here is an example:

| makeresults 
| eval Date="4/2/2018" 
| eval timestampDate=strptime(Date, "%m/%d/%Y") 
| eval timestampStart=strptime("4/2/2018", "%m/%d/%Y") 
| eval timestampEnd=strptime("4/10/2018", "%m/%d/%Y") 
| eval formattedTimestamp = strftime(timestamp,"%Y-%m-%dT%H:%M:%S") 
| where timestampDate >= timestampStart AND timestampDate <= timestampEnd

richgalloway
SplunkTrust
SplunkTrust

Dates cannot be compared as strings. You must convert them to integer (epoch) form for proper comparison. Try this in your query:

... | where (strptime(Date, "%m/%d/%Y")>=strptime("4/2/2018", "%m/%d/%Y")) AND (strptime(Date, "%m/%d/%Y")>=strptime("4/10/2018", "%m/%d/%Y")) | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...