Date Range in saved search not working correctly

Identity Security Cloud (ISC) ISC Discussion and Questions
1

I’m trying to return a list of all terminated users from the previous day. I set my search query to “attributes.cloudLifecycleState:terminated AND attributes.endDate:[now-1d TO now]”. This returns no results but I know we have a user that was terminated the previous day.

If i change the query to “attributes.cloudLifecycleState:terminated AND attributes.endDate:[now-2d TO now]” then the terminated user shows up. Wondering how Sailpoint interprets “now” since it doesn’t appear to be current date/time.

2

Yes, that’s the right observation.

3

Sorry can you elaborate? Also our values in the “endDate” field is just something like “11/8/2023”. When Sailpoint sees this, is it defaulting to 11/8/2023 12 AM UTC since we don’t have a timestamp associated with the date?

Is “now” literally the current datetime when the saved search is ran?

4

Yes, that’s why in the search results you don’t see the users who were terminated the previous day

5

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.