Datetime Searches

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Does the IdentityNow search support datetime searches? Specifically, can we do a query such as:

created:>=2022-10-27T14:01:48+00:00

I have tried a few different formats but no matter what the query will error out.

2

I figured out a solution. You can use Unix Epoch formatted to milliseconds. For example:

created:>=1667784438000
3

Hey @bostelmann, thanks for not only coming back and sharing the answer you found, but even marking it as the solution :slight_smile:

Just wanted to give you a kudos for that one!

Season 9 Thank You GIF by The Office

4

lol, thank you @jordan_violet!

Any way we can update the documentation on SailPoint Product Documentation to capture this detail?

5

I will share this with the product documentation team to fix!

1 Like
6

Hi Blaise!

My name is Rebekah Reveile and I’m with the Product Documentation team. I want to make sure I completely understand what you were hoping for and what happened before I add this to the docs. I’m also checking with the dev team to make sure this is intentional behavior and not a bug.

Our docs currently state that we support ISO8601 format for search queries. Were you able to get this format to work without including milliseconds?

7

I am sure this is probably a bug, but just compare the search results between these two queries:

  1. created:<=2022-12-20T18:29:02Z

  2. created:<=1671564258000

Both queries represent the same thing, but No.1 is in ISO8601 format while No. 2 is in Unix Epoch format. Query No.1 will fail during execution, but Query No.2 will work.

Ultimately SailPoint should fully support searching in ISO8601, currently it only works for the date portion (2022-12-20) but not the time portion (18:29:02Z). In the meantime, users can use Unix Epoch format since it is fully supported. It will make sense to indicate this in your documentation as well.

1 Like
8

Thanks, Blaise! This is really useful information. I’m going to make sure the developers know that this is going on, and I’ll add it to the docs. Thank you for making sure this gets passed along.

1 Like
9

I’ve checked with the developer and it looks like the reason this isn’t working is because our current implementation requires that we escape the colon characters using a backslash.

created:<=2022-12-20T18\:29\:02Z works in my environment, but it fails if I remove the slashes.

I’ll be adding this to the docs. Thank you for your patience.

2 Likes