Search field value in interval

[light_of_sirius]

Hello,

i am trying to search for field values in intervall (79,90).

Both versions do not work properly as i know what to expect.

v1

index=XXX  earliest="08/03/2020:15:00:00" latest="08/03/2020:16:30:00" TEMP<90 TEMP>79 
| stats count as Counter  

 v2

index=XXX  earliest="08/03/2020:15:00:00" latest="08/03/2020:16:30:00" TEMP<90 AND TEMP>79 
| stats count as Counter   

[thambisetty · Accepted solution]

is TEMP field ?

I have tried below and working fine.

index=_internal earliest="09/14/2020:11:00:00" latest="09/14/2020:13:00:00" date_hour>11 date_hour<13

[light_of_sirius]

Yeah it works fine. Turns out what i expected to expect was not what i should have expected 🙂 Sry

[ITWhisperer]

Your date time format seems a little different, usually there is a space between the date and the time not a colon. Do you have some sample data events you could share?

[thambisetty]

@ITWhisperer 

earliest and latest time format will have column in between date & time.

[ITWhisperer]

Yes I just checked _internal - still would be useful to have some sample data though