Unable to perform date logic in custom identity attribute search

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi all,

I have found a bug (or at least behavior that is not clearly documented) regarding IDN datemath in searches. I created an identity attribute formatted in ISO8601 and am unable to perform any sort of date searches (like [now-100d TO now]). I am, however, able to run the exact same search using the OOTB endDate identity attribute. I assume this is because OOTB endDate and startDate are classified as dates instead of strings - is there any way to change my custom identity attribute type from string to date?

Also, as an aside, is it possible to run a search query for all things that happened exactly a week ago? I imagine the search comparison operator would look something like ==(now-7d) but I get a date formatting error when trying this.

2

Hi @dominick-miller,

Have you taken a look at the below article.? Not sure how it would behave on a custom attribute.

For your second query, something like this would work :

created:[now-7d TO now-6d]

1 Like
3

If the date attribute used for this search is in yyyy-MM-dd format then you can use
attributes.startDate:[now-7d/d TO now-7d/d]

However this does not answer first part of your question

2 Likes
4

Hey @dominick-miller!

This is something that is not covered thoroughly enough in the IDN/ISC documentation, in my opinion. It’s actually really only referenced as a footnote in the Search documentation: when creating a custom attribute that you want to search against as a date, you need to append DateType to the end of the attribute’s system name. This will tell the system that this attribute should be of type date, rather than the default which is string.

This gets a small mention at the bottom of the Second Level Field for Identities section of the Searchable Fields documentation, and is also discussed a bit in the Compass forum.

Once you’ve renamed the identity attribute and refreshed your identities, you should be able to use the flexible date search parameters against your custom identity attribute. Let us know if it gives you any more trouble!

3 Likes
5

You’ll want to box your search a bit more. now isn’t just a date, but also includes the time, so you’d effectively only be looking for things that happened exactly one week ago, at the exact same time. We could round that now to the day with /d, but that still would only find records where the event happened at exactly midnight. In fact, the now keyword actually doesn’t appear to work by itself, it seems to need to be part of a ranged query ([now-1d TO now], for example).

What you’d want to do is actually define the period for which you want your results. [now-7d TO now-6d] would give you results from 7 days ago to 6 days ago, for instance.

1 Like