Splunk Search

How to find events between date ranges?

jimbolya11
New Member

This has been answered but using the methods still do not provide the right results.
I have a date column. Format is like 4/2/2018.
I need to be able to find the events between date ranges. I've tried the conversion methods posted in answers, but when I do a WHERE Date>="4/2/2018" AND Date<="4/10/2018" the results pull a huge range of dates within 4/2018.

Cheers ~

0 Karma

jconger
Splunk Employee
Splunk Employee

For Date conversion, see this -> https://answers.splunk.com/answers/638427/convert-string-to-date-1.html

Your WHERE command is comparing a timestamp to a string. You'll need to convert the string to a timestamp. Here is an example:

| makeresults 
| eval Date="4/2/2018" 
| eval timestampDate=strptime(Date, "%m/%d/%Y") 
| eval timestampStart=strptime("4/2/2018", "%m/%d/%Y") 
| eval timestampEnd=strptime("4/10/2018", "%m/%d/%Y") 
| eval formattedTimestamp = strftime(timestamp,"%Y-%m-%dT%H:%M:%S") 
| where timestampDate >= timestampStart AND timestampDate <= timestampEnd

richgalloway
SplunkTrust
SplunkTrust

Dates cannot be compared as strings. You must convert them to integer (epoch) form for proper comparison. Try this in your query:

... | where (strptime(Date, "%m/%d/%Y")>=strptime("4/2/2018", "%m/%d/%Y")) AND (strptime(Date, "%m/%d/%Y")>=strptime("4/10/2018", "%m/%d/%Y")) | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...