RQL - Checking tags using _DateTime function

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

RQL - Checking tags using _DateTime function

L0 Member

Can _DateTime function be used to check the date of a tag on a resource in AWS? My current query syntax is accepted by prisma however the _DateTime functions are not actually checking the tag (type string because all tags are strings in AWS) so it is returning undesired output.


Current query (should return all volumes with a (tag.key=Retain).value greater than 365 days old:
config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-volumes' AND AND json.rule = _DateTime.ageInDays(tags[?(@.key=='Retain')].value) > 365 addcolumn tags[?(@.key=='Retain')].value

Are there any examples of checking a tag using the _DateTime function or any other ways to work with a date in prisma to check the value of a tag's date? Or any useful links/resources to look into this further are appreciated! Prisma Cloud AWS 


L2 Linker

It seems that the way the documentation is written that while it is possible to use the _DateTime function to get the various time and age related properties from a resources, it doesen't seem to be possible to use it to get the time and date of attributes of the resources.  If you look at the examples, you can use the TimeDate function against resources an EC2 instance or a key, but not from an attribute of the recourse, like a tag. 

  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!