I'm having problems with writing a simple KQL query in Log Analytics Workspace. Basically I want to filter out all Application Registrations that have secret expiry date longer than 3 years.
I have made a following query, but I think my custom made datetime is still considered a string, instead of datetime type.
Here is the query:
//create a new date which is 3 years later than today
let newyear = format_datetime(datetime_add('year',3,datetime(now)), 'M/d/y, h:m:s.fff tt');
//Query the AppRegs for SecretEndDate ending at least in 2025
AppRegExp_CL
|project AppRegName_s, AppID_g, SecretEndDate_t
|where SecretEndDate_t >= datetime(newyear)
I'm always getting the same error:
Query could not be parsed at 'datetime(newyear)'on line [6,0]
I've tried using makedatetime(), to_datetime() but the result was the same.
Normally I'm not working on KQL queries, so maybe I'm missing something very obvious. I hope that you can help me out. Thanks
Since SecretEndDate_t is of datetime type, no conversion is needed.
//create a new date which is 3 years later than today
let newyear = datetime_add('year', 3, now());
//Query the AppRegs for SecretEndDate ending at least in 2025
AppRegExp_CL
|project AppRegName_s, AppID_g, SecretEndDate_t
|where SecretEndDate_t >= newyear
Related
I am trying to create a sentinel query using KQL which would only search for information on certain dates such as bank holidays. I have seen this can be done on other query languages however best I have created so far is having multiple dates in a row such as
let startdate = (datetime(23/09/2022));
let enddate = (datetime(26/09/2022));
where timegenerated between (startdate .. enddate)
However this does not allow multiple different date slots. I have tried below creating an array of dates however '!contains' is invalid with timegenerated field. Does anyone know a fix for this?
let HolidayDates = datatable(HDates: string)
[
'24/12/2022',
'25/12/2022',
//first holiday
'01/01/2023',
'02/01/2023',
'03/01/2023',
//New years
'07/04/2023',
'08/04/2023',
'09/04/2023',
'10/04/2023'
//easter holiday
];
| where TimeGenerated !contain (HolidayDates)
You can do this like this:
let HolidayDateTimes = datatable(HDates: datetime )
[
datetime(2022-12-24),
datetime(2022-09-27),
datetime(2022-12-25)];
traces | where startofday(timestamp) in (HolidayDateTimes)
Intead of using contains, which is a string operator, use the in operation to check whether an item is in a collection. Then I use startofday to strip away the time information.
We are trying in a RESTLet to access the sublist "demandplandetail" from a NetSuite Item Demand Plan. Everything goes fine until a certain point. We are able to load it and process the demandplan for 2020. However, here it gets frustrating.
We know (can see from NetSuite) that there is data also for 2021. However, to access that from SuiteScript seems very difficult.
1st solution) The item demand plan has the field "year". OK, just set that to 2021, save and reload the record. Result: saving ignored, year still is 2020.
2nd solution) Set the year using a Date object as in:
var demandPlan = record.load(...)
var d = new Date();
demandPlan.setValue({
fieldId: 'year',
value: d
});
Gives the following:
:"TypeError: Cannot find function getFullYear in object NaN. (NLRecordScripting.scriptInit$lib#59)","stack":["setDatesForMonthAndYear(NLRecordScripting.scriptInit:108)","anonymous(N/serverRecordService)"
on saving the record. I also get the same using (various) strings adhering to acceptable date formats (as in '1/1/2021'). I have also tried the format package giving me a date string -> the same result.
Also read somewhere that you may need to set the start date (field 'startdate') in the record. Tried several variations but it stubbornly refuses :(.
Wonder if anyone has seen anything similar?
Best Regards,
Toni
Hi Please try the below code also check if you're passing date object to the field not the date string.
function formatDate() {
var dateROBD = format.parse({
value: new Date(),
type: format.Type.DATE
});
// this line optional if you want to try with or else ignore this
dateROBD = convertUTCDateToLocalDate(new Date(dateROBD));
return dateROBD;
}
function convertUTCDateToLocalDate(date) {
var newDate = new Date(date.getTime() + date.getTimezoneOffset() * 60 * 1000);
var offset = date.getTimezoneOffset() / 60;
var hours = date.getHours();
newDate.setHours(hours - offset);
return newDate;
}
OK, mystery solved. Turned out that this is not supported in SuiteScript 2.0 but you need to use 1.0.
I have document contains properties like this
{
"id":"1bd13f8f-b56a-48cb-9b49-7fc4d88beeac",
"name":"Sam",
"createdOnDateTime": "2018-07-23T12:47:42.6407069Z"
}
I want to query a document on basis of createdOnDateTime which is stored as string.
query e.g. -
SELECT * FROM c where c.createdOnDateTime>='2018-07-23' AND c.createdOnDateTime<='2018-07-23'
This will return all documents which are created on that day.
I am providing date value from date selector which gives only date without time so, it gives me problem while comparing date.
Is there any way to remove time from createdOnDateTime property or is there any other way to achieve this?
CosmosDB clients are storing timestamps in ISO8601 format and one of the good reasons to do so is that its lexicographical order matches the flow of time. Meaning - you can sort and compare those strings and get them ordered by time they represent.
So in this case you don't need to remove time components just modify the passed in parameters to get the result you need. If you want all entries from entire date of 2018-07-23 then you can use query:
SELECT * FROM c
WHERE c.createdOnDateTime >= '2018-07-23'
AND c.createdOnDateTime < '2018-07-24'
Please note that this query can use a RANGE index on createdOnDateTime.
Please use User Defined Function to implement your requirement, no need to update createdOnDateTime property.
UDF：
function con(date){
var myDate = new Date(date);
var month = myDate.getMonth()+1;
if(month<10){
month = "0"+month;
}
return myDate.getFullYear()+"-"+month+"-"+myDate.getDate();
}
SQL：
SELECT c.id,c.createdOnDateTime FROM c where udf.con(c.createdOnDateTime)>='2018-07-23' AND udf.con(c.createdOnDateTime)<='2018-07-23'
Output :
Hope it helps you.
I am trying to return search results for every document that was created on a day. Below is the query I use.
var query = Document.find({}).populate('contacts');
var gte = moment(req.query.date, 'DD-MM-YYYY').startOf('Day');
var lte = moment(req.query.date, 'DD-MM-YYYY').endOf('Day');
query.where('dates.createdAt').gte(gte).lt(lte);
This query works for some days but not all. I can't seem to understand the behaviour. Please help out.
The format of the date in the query string is DD/MM/YYYY.
Works for : 2016-04-16T00:02:30.065Z
Does not work for: 2016-04-15T19:02:59.758Z
It's wrong because you don't initialize as .utc(), and MongoDB dates are stored in UTC:
var gte = moment.utc(req.query.date, 'DD-MM-YYYY');
var lte = moment.utc(req.query.date, 'DD-MM-YYYY').endOf('Day');
And there is no need for the startOf() either.
If you don't construct like that, then the resulting Date object is skewed by the difference in the local timezone. Hence why you don't see the selection working where the hours would cross over dates.
Also if dates are coming in as 01/01/2016 then the format string would be 'DD/MM/YYYY', but one or the other is likely a typo in your question.
At the moment using JavaScript I'm attaching a date to every single object similar to the following.
post.date = getTimestamp(post._id).toDateString();
I can then access 'date' from within my template. Is there a nicer way to extract the date?
I'm not sure if this will work in a template, but:
post._id.getTimestamp();
returns an ISODate.
http://mongodb.github.com/node-mongodb-native/api-bson-generated/objectid.html#gettimestamp
If _id is UUID, then first 8 bytes of it is timestamp.
You may, fore example, extract date as follows:
var date = new Date( parseInt( post._id.substring(0,8), 16 ) * 1000 )