Skip to main content

Date and Time Operators

Date and time operators evaluate attributes of type Date, DateTime, Time, or any other calculated attribute that returns these attribute types. These operators help filter results based on specific dates or relative timeframes.

info

Date and time operators are not case-sensitive. For example, IN LAST, In Last, and in last are all valid.

note

In list views and Explorer graphs, BQL only supports the YYYY-MM-DD format (2022-04-20 for April 20th, 2022). You can use additional date formats in dashboard charts and visualizations. For additional information, see Supported date formats.

Supported time units​

The following date and time units are supported. They are not case-sensitive and do not need to be wrapped in quotes:

  • ms, milli, millis, milliseconds
  • s, second, seconds
  • minute, minutes
  • hour, hours
  • day, days
  • week, weeks
  • month, months
  • year, years

Rolling time windows​

The IN LAST, IN NEXT, NOT IN LAST, and NOT IN NEXT operators use a rolling time window relative to the current timestamp. The window may not align to calendar boundaries such as the start of a week or month.

For example, IN LAST 2 weeks means the current timestamp minus 14 days, regardless of what day of the week it is.

When grouping query results by a time unit (such as week), the rolling window may produce one additional bucket beyond the specified count. For example, IN LAST 4 weeks grouped by week may return up to 5 weekly buckets, because the window spans parts of two different calendar weeks at each end.

To get exact calendar-aligned buckets, use BETWEEN with dates that align to the desired boundaries (for example, start and end on a Monday for weekly grouping).

IS​

Use IS to find records that match a specific date.

FIND Ticket AS t WHERE t.lastUpdated IS 2025-01-31

The above query returns tickets that were last updated on January 31st, 2025.

IS NOT​

Use IS NOT to find records that do not match a specific date.

FIND Ticket AS t WHERE t.lastUpdated IS NOT 2025-01-31

The above query returns tickets last updated on a different date other than January 31st, 2025.

SINCE​

Use SINCE to find records updated after a specific date.

FIND Vulnerability AS v WHERE v.lastUpdated SINCE 2025-02-01

The above query returns vulnerabilities last updated after February 1st, 2025.

BEFORE​

Use BEFORE to find records updated before a specific date.

FIND Vulnerability AS v WHERE v.lastUpdated BEFORE 2025-02-01

The above query returns vulnerabilities last updated before February 1st, 2025.

BETWEEN​

Use BETWEEN to find records with date values between two specific dates.

When using BETWEEN, keep the following in mind:

  • Enclose the date range in brackets: [ ]
  • Separate the start and end dates with the keyword TO.
  • Dates must follow the YYYY-MM-DD format in List views and Explorer.
FIND Finding AS f WHERE f.dateCreated BETWEEN [2025-01-01 TO 2025-04-15]

The above query returns all findings created between January 1st, 2025 and April 15th, 2025.

NOT BETWEEN​

Use NOT BETWEEN to exclude records whose date falls within a range.

When using NOT BETWEEN, keep the following in mind:

  • Enclose the date range in brackets: [ ]
  • Separate the start and end dates with the keyword TO.
  • Dates must follow the YYYY-MM-DD format in List views and Explorer.
FIND Finding AS f WHERE f.dateCreated NOT BETWEEN [2025-01-01 TO 2025-04-15]

The above query returns all findings created outside the given date range of January 1st, 2025 to April 15th, 2025.

IN NEXT​

Use IN NEXT to find records with a future date within a specific time window.

FIND Finding AS f where f.dueDate IN NEXT 1 month

The above query returns all findings due within the next month.

NOT IN NEXT​

Use NOT IN NEXT to exclude records with a future date within a specific time window.

FIND TICKET AS t WHERE t.dueDate NOT IN NEXT 3 weeks

The above query returns all tickets not due within the next three weeks.

IN LAST​

Use IN LAST to find records with a past date within a specific time window.

FIND Vulnerability AS v WHERE v.dateCreated IN LAST 1 day

The above query returns all vulnerabilities created within the last day.

NOT IN LAST​

Use NOT IN LAST to exclude records from a recent timeframe.

FIND Vulnerability AS v WHERE v.dateCreated NOT IN LAST 1 month

The above query returns all vulnerabilities not created in the last month.

Last updated on