I am trying to find entries between a date-time range based on a field in the event 'Date'. It date-time value of the field is in the format - %Y-%m-%d %H:%M:%S.
I am using below query:
(index=myindex) ((strptime(Date, "%Y-%m-%d %H:%M:%S")>=strptime("2023-02-11 00:00:00", "%Y-%m-%d %H:%M:%S")) AND (strptime(Date, "%Y-%m-%d %H:%M:%S")>=strptime("2023-02-11 23:59:59", "%Y-%m-%d %H:%M:%S")))
It is giving me below Error:
Error in 'search' command: Unable to parse the search: Comparator '>=' has an invalid term on the left hand side: (Date "%Y-%m-%d %H:%M:%S").
Sample Data:
{
"InterfaceNumber": "I-XXXX",
"SystemCode": "sys",
"Element": "JobID:bw0a104of",
"Data": "",
"Severity": "Error",
"ProcessContext_ProcessId": "bw0a104of",
"Subject": "/api/login",
"Date": "2023-02-14 12:25:01",
"ErrorMessages": "This is an Error",
"ProcessContext_ProjectName": "MyApp.application",
"HostName": "localhost.mydomain.com",
"ProcessContext_RestartedFromCheckpoint": false,
"ProcessContext_EngineName": "MyApp"
}
Not sure what I am doing wrong. Any help appreciated.
--
... View more
