How to use _time in where clause with like

[ankurborah]

I have to use a date filed fields.updated to filter records the I have to filter based on matching Year-Month as below.

index=Jira_ticket_idx*|rename fields.updated as NewDate|eval NewDate=strptime(strftime(strptime(NewDate, "%Y-%m-%dT%H:%M:%S"),"%Y-%m-%d"),"%Y-%m-%d")|eval _time=NewDate|where like(_time,"%2017-08%")|timechart count

Need experts help.

[richgalloway · Accepted solution]

The strptime function returns an epoch (integer) timestamp. This means the like function will fail because one can't compare an integer to a string. Try this query.

index=Jira_ticket_idx*|rename fields.updated as NewDate|where like(NewDate, "%2017-08%") | eval _time=strptime(NewDate, "%Y-%m-%dT%H:%M:%S") | timechart count