I'm newer of splunk. On my log I've a JSON with two fields of interested: "initialCreationDate":"2020-03-02T00:00:00","finalCreationDate":"2020-04-01T11:53:29". My goal is take the count where the results have a range in between these fields. At this time I tried get only the first field and make a count using > at a String example. But it's not working.
index=foo | rex field=raw "REQ=(?<REQ>[^}]+})" | spath input=REQ | eval n=strptime(REQ.initialCreationDate,"%Y-%m-%dT%H:%M:%S") | stats count by n > strptime("2020-03-26T00:00:00").