I am trying to select a date range based on a single date field within a log. As an example - sourcetype="tickets" SubmitDate between 01/01/17 - 01/31/17. Any help would be appreciated.
You could try a search like this:
sourcetype=tickets | eval SubmitDateEpoch=strptime(SubmitDate,"%m/%d/%Y") | where SubmitDateEpoch > strptime("02/15/17","%m/%d/%Y") AND SubmitDateEpoch < strptime("02/20/17","%m/%d/%Y")
You may also put the calculation into a macro (so everything starting from | eval
) and send the start end end date for your search to as arguments to that macro.
The macro definition would be (given your variable names are arg1 and arg2):
| eval SubmitDateEpoch=strptime(SubmitDate,"%m/%d/%Y") | where SubmitDateEpoch > strptime("$arg1$","%m/%d/%Y") AND SubmitDateEpoch < strptime("$arg2$","%m/%d/%Y")
Your search could look like this in that case:
sourcetype=tickets `submitrange("02/15/17","02/20/17")`