I am trying to select a date range based on a single date field within a log. As an example - sourcetype="tickets" SubmitDate between 01/01/17 - 01/31/17. Any help would be appreciated.

[ChipOC]

I am trying to select a date range based on a single date field within a log. As an example - sourcetype="tickets" SubmitDate between 01/01/17 - 01/31/17. Any help would be appreciated.

[DMohn]

You could try a search like this:

sourcetype=tickets | eval SubmitDateEpoch=strptime(SubmitDate,"%m/%d/%Y") | where SubmitDateEpoch > strptime("02/15/17","%m/%d/%Y") AND SubmitDateEpoch < strptime("02/20/17","%m/%d/%Y")

You may also put the calculation into a macro (so everything starting from | eval) and send the start end end date for your search to as arguments to that macro.

The macro definition would be (given your variable names are arg1 and arg2):

| eval SubmitDateEpoch=strptime(SubmitDate,"%m/%d/%Y") | where SubmitDateEpoch > strptime("$arg1$","%m/%d/%Y") AND SubmitDateEpoch < strptime("$arg2$","%m/%d/%Y")

Your search could look like this in that case:

sourcetype=tickets `submitrange("02/15/17","02/20/17")`