Date Format issue in IdentityNow Search

Identity Security Cloud (ISC) ISC Discussion and Questions
1

:bangbang: Please be sure you’ve read the docs and API specs before asking for help. Also, please be sure you’ve searched the forum for your answer before you create a new topic.

I want to fetch the last execution time of aggregation for particular source.
I am executing below search query to fetch aggregation details. but Sort is not working on Creation Date as it is in String format
Is there any way to format the date in search query.

2

Hello,

I am not seeing any search query posted in your message, could you resend it?

3

{
“indices”: [
“events”
],
“query”: {
“query”: “name:"Aggregate Source Account" AND attributes.sourceName:"MyAgency" AND created:[now-1M TO now] AND NOT exists:errors AND status:PASSED”,
“fields”: [
“created”
],
“timeZone”: “America/Chicago”,
“sort”: [
“-created”
]
}
}

4

Is this for a workflow HTTP request?

5

This API will be called from outside of IDN, to fetch the last aggregation time for delta aggregation API.
Target Delta API will return all data modified after last aggregation time

6

You need to move these outside the {} of "query" : { . they are here now . }

Below is the tested and working body

{
    "indices": ["events"],
    "query":{
        "query": "name:\"Aggregate Source Account\"  AND attributes.sourceName:\"NAME OF SOURCE\" AND created:[now-1M TO now] AND NOT exists:errors"
    },
    "timeZone": "America/Chicago",
    "sort":["-created"],
    "queryResultFilter":
    {
        "includes": [
            "created"
        ]
    }
}

response

[
    {
        "created": "2024-04-16T00:41:33.971Z",
        "_type": "event",
        "type": "event",
        "_version": "v7"
    },
    {
        "created": "2024-04-16T00:41:29.537Z",
        "_type": "event",
        "type": "event",
        "_version": "v7"
    },
    {
        "created": "2024-04-16T00:39:23.777Z",
        "_type": "event",
        "type": "event",
        "_version": "v7"
    },
7

Thanks a lot Nithesh. It worked