Need to eval date range instead of relative time from custom time field.

[matt4321]

I am currently using this method to use date from custom field for relative time frames which only gives me 3 months.

| eval NewTime=strptime(ProjCreatedDate,"%Y-%m-%d %H:%M:%S")
| eval _time=NewTime
| where _time>=relative_time(now(),"-3mon") AND _time

I need to get instead of relative time Last 3 months I need a time range.. From 1/1/2017 to 5/21/2017.

[somesoni2]

Can you explain your requirement more, possibly with an example of what you currently get and what you expect?

[matt4321]

Yes sorry for some reason this posted with my bottom question not in there. I need to get instead of relative time Last 3 months I need a time range.. From 1/1/2017 to 5/21/2017.

[somesoni2]

If you're trying to compare against the specific/static dates, do like this

your base search | eval _time=strptime(ProjCreatedDate,"%Y-%m-%d %H:%M:%S")
| where _time>=strptime("1/1/2017","%m/%d/%Y") AND _time<=strptime("5/21/2017","%m/%d/%Y") 

[matt4321]

This worked perfect Thank you very much!! Trying to change this to the answer now.

[gcusello]

Hi matt4321,
try something like this:

your_search
| eval NewTime=strptime(ProjCreatedDate,"%Y-%m-%d %H:%M:%S")
| where NewTime>=relative_time(now(),"-3mon") 

I didn't understood the second condition "AND _time"

Bye.
giuseppe

[matt4321]

Awesome I was wondering about that as well.. I will remove it and see how it goes.

Do you know about the updated comment?
"I need to get instead of relative time Last 3 months I need a time range.. From 1/1/2017 to 5/21/2017."

Any help would be appreciated.

[gcusello]

as suggested by @somesoni2 modify the where condition with

| where _time>=strptime("1/1/2017","%m/%d/%Y") AND _time<=strptime("5/21/2017","%m/%d/%Y") 

Bye.
Giuseppe

[gcusello]

If this answer satisfies your question, please accept or upvote it.
Bye.
Giuseppe