Hello, does anyone have any experience crafting search queries within the [Get List of Identities] action of workflows?
I want to schedule a workflow to run in the early AM which identifies users on their start-date.
Each Identity has a “formattedStartDate” and a “currentDate” attribute formatted in yyyy/mm/dd. It should be a simple matter to build a search query, but the variable selector is difficult to navigate. Does anyone have any workflows that accomplish this?
perform your required search you want through the search UI, once you have your query the way you need it, use the Get List of Identities action and use search Query in the “Find Identities By” field and past your search query in.
When you do this, you will then need to use a loop operator. You are constrained to around 250 returned records.
Hi Fred. Great minds think alike. I’ve been considering that, but was having a tough time crafting a search. I know you can utilize [now] within certain queries. Can it be utilized with a compare operator?
I see it called out in the query documentation here https://documentation.sailpoint.com/saas/help/search/building-query.html
There’s even a specific screenshot overviewing Date Comparisons
However, when I try to use either attributes.startDate or attributes.formattedStartDate I get no results. The latter is iso 8601
Am I on the right track?
attributes.startDate:[now-1M TO now]
this works for me just fine. The startDate is formatted as yyyy-MM-dd. In order to do comparisons with NOW, you have to have the date formatted correctly
Darn, no luck.
attributes.formattedStartDate:"2025/07/11"
String matching works just fine.
Our Authoritative Source delivers startDate as dd-MMM-yyyy (technically it’s a string up stream). We pass it through a transform and build a 2nd identity attribute called formattedStartDate.
I assume IDN treats that like a legitimate date, but if it fails in elasticsearch, maybe not?
"name": "Format Start Date",
"type": "dateFormat",
"attributes": {"input": { "bla bla"}, },
"inputFormat": "dd-MMM-yyyy",
"outputFormat": "yyyy/MM/dd"
you need dashes rather than slashes
Hi @RPook
Please refer to this thread,
It has been already marked as solution you can follow the same method, and use that in the workflow action to find the identities.
Please letme know if you still face any issues.
Hope this helps 
Looks like you beat me to it by about a year!
My former transform looked like this with the slashes
I see the change in my Identity Attributes. I can successfully string match elasticSearch
attributes.formattedStartDate:"2025-07-14"
However, I cannot utilize the [now] within elasticSearch.
attributes.formattedStartDate:[now-1M TO now]
The transform looks to be functioning correctly. Am I missing something obvious?
Hello Ryan,
In order to allow the searching via the now attribute please follow the above thread that i had shared.
There are few requirements that needs to be met first in order to search using now keyword.
Well I’ll be… The former architects of this system built an attribute called, formattedStartDate and went through the effort of transforming data (with dashes, not slashes). Now I find that the attribute is configured as "type": "string",
I’ve updated the Identity Attribute type via VSCode.
The active que is currently empty despite the change.
I’ve manually processed a number of individual identities, but the elasticsearch still returns null results with [now-1M TO now] . Only string matching works.
I am guessing it will not go into effect until the 8pm refresh.
What a rabbit hole…
I’ve built a net-new attribute called “deletemetimeDateType”, but when I inspect the attribute in vsCode it claims the type is a string.
Any idea how SailPoint handles attribute types? I see references to string and boolean within their API library but there does not appear to be anything in the UI when I built the
“deletemetimeDateType” attribute. I was only prompted for the name. Does appending the name with ‘DateType’ make the difference?
I’ve tried editing the attribute’s type in vsCode directly but I am not sure if that functions as intended.
Ryan, yes i think the name only holds the significance in this case as the documentation only states about adding “dateType”
Link: Searchable Fields - SailPoint Identity Services.
Appending the displayName of the attribute was the solution. The JSON “TYPE” field had nothing to do with it.
