Splunk Search

How to find events between date ranges?

jimbolya11
New Member

This has been answered but using the methods still do not provide the right results.
I have a date column. Format is like 4/2/2018.
I need to be able to find the events between date ranges. I've tried the conversion methods posted in answers, but when I do a WHERE Date>="4/2/2018" AND Date<="4/10/2018" the results pull a huge range of dates within 4/2018.

Cheers ~

0 Karma

jconger
Splunk Employee
Splunk Employee

For Date conversion, see this -> https://answers.splunk.com/answers/638427/convert-string-to-date-1.html

Your WHERE command is comparing a timestamp to a string. You'll need to convert the string to a timestamp. Here is an example:

| makeresults 
| eval Date="4/2/2018" 
| eval timestampDate=strptime(Date, "%m/%d/%Y") 
| eval timestampStart=strptime("4/2/2018", "%m/%d/%Y") 
| eval timestampEnd=strptime("4/10/2018", "%m/%d/%Y") 
| eval formattedTimestamp = strftime(timestamp,"%Y-%m-%dT%H:%M:%S") 
| where timestampDate >= timestampStart AND timestampDate <= timestampEnd

richgalloway
SplunkTrust
SplunkTrust

Dates cannot be compared as strings. You must convert them to integer (epoch) form for proper comparison. Try this in your query:

... | where (strptime(Date, "%m/%d/%Y")>=strptime("4/2/2018", "%m/%d/%Y")) AND (strptime(Date, "%m/%d/%Y")>=strptime("4/10/2018", "%m/%d/%Y")) | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...