Splunk Search

How to find events between date ranges

riveraj1
Observer

I am trying to find the events that are taking place between March 1 2021 and September 1 2021. I was hoping someone could tell me where I am going wrong in my search.

| eval timestampDate=strptime(ScheduledStartDate, "%m/%d/%Y")
| eval project_start=strptime("03/01/2021", "%m/%d/%Y")
| eval project_end=strptime("09/01/2021", "%m/%d/%Y")
| eval formattedTimestamp = strftime(timestamp, "%Y-%m-%d")
| where timestampDate >= project_start AND timestampDate <= project_end
| table Country timestampDate

Labels (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @riveraj1,

Assuming the time range covers the required events, everything seems fine, maybe there is a simple typo. Can you please share a few sample events?

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...