topic Re: Unable to generate time interval into multi value field in Splunk Enterprise

Unable to generate time interval into multi value field

jiaminyun — Tue, 21 Jan 2025 08:03:54 GMT

My requirement is that my start time is January 1, 2024 and end time is January 7, 2024. In addition to placing the start and end times in multi value fields, please also include each date in this time interval, such as January 2, 2024, January 3, 2024, January 4, 2024, January 5, 2024, January 6, 2024. The final field content should be January 1, 2024, January 2, 2024, January 3, 2024, January 4, 2024, January 5, 2024, January 6, 2024, and July.
The SPL statement is as follows:

| makeresults | eval start_date = "2024-01-01", end_date = "2024-01-07" | eval start_timestamp = strptime(start_date, "%Y-%m-%d") | eval end_timestamp = strptime(end_date, "%Y-%m-%d") | eval num_days = round((end_timestamp - start_timestamp) / 86400) | eval range = mvrange(1, num_days) | eval intermediate_dates = strftime(relative_time(start_timestamp, "+".tostring(range)."days"), "%Y-%m-%d") | eval all_dates = mvappend(start_date, intermediate_dates) | eval all_dates = mvappend(all_dates, end_date) | fields all_dates

Re: Unable to generate time interval into multi value field

ITWhisperer — Tue, 21 Jan 2025 08:30:38 GMT

| makeresults | eval start_date = "2024-01-01", end_date = "2024-01-07" | eval start_timestamp = strptime(start_date, "%Y-%m-%d") | eval end_timestamp = strptime(end_date, "%Y-%m-%d") | eval num_days = round((end_timestamp - start_timestamp) / 86400) | eval all_dates = start_date | eval range = mvrange(1, num_days + 1) | foreach mode=multivalue range [| eval all_dates=mvappend(all_dates,strftime(relative_time(start_timestamp,"+".<<ITEM>>."d"),"%Y-%m-%d"))] | fields all_dates

Re: Unable to generate time interval into multi value field

jiaminyun — Wed, 22 Jan 2025 02:45:52 GMT

Thank you for your response, it has solved my problem!