<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How can I only show rows from next 6 months based on the datestamp? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-can-I-only-show-rows-from-next-6-months-based-on-the/m-p/413695#M73194</link>
    <description>&lt;P&gt;That worked, thank you!&lt;/P&gt;</description>
    <pubDate>Mon, 21 May 2018 23:24:06 GMT</pubDate>
    <dc:creator>rkassabov</dc:creator>
    <dc:date>2018-05-21T23:24:06Z</dc:date>
    <item>
      <title>How can I only show rows from next 6 months based on the datestamp?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-can-I-only-show-rows-from-next-6-months-based-on-the/m-p/413691#M73190</link>
      <description>&lt;P&gt;I am trying to only show records that have "md_createdAt" fields that occur in the next 6 months, looking forward from that day's date. How would I only show these records?&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;|`init("xxx")`
| eval month=strftime(strptime(md_createdAt,"%Y-%m-%d %H:%M:%S.%6N"),"%b")
| table info_subType md_createdAt month
| chart count(info_subType) over month by md_createdAt
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Mon, 21 May 2018 19:12:10 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-can-I-only-show-rows-from-next-6-months-based-on-the/m-p/413691#M73190</guid>
      <dc:creator>rkassabov</dc:creator>
      <dc:date>2018-05-21T19:12:10Z</dc:date>
    </item>
    <item>
      <title>Re: How can I only show rows from next 6 months based on the datestamp?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-can-I-only-show-rows-from-next-6-months-based-on-the/m-p/413692#M73191</link>
      <description>&lt;P&gt;md_createdAt should be 6 month in future from today's date?&lt;/P&gt;</description>
      <pubDate>Mon, 21 May 2018 19:36:41 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-can-I-only-show-rows-from-next-6-months-based-on-the/m-p/413692#M73191</guid>
      <dc:creator>somesoni2</dc:creator>
      <dc:date>2018-05-21T19:36:41Z</dc:date>
    </item>
    <item>
      <title>Re: How can I only show rows from next 6 months based on the datestamp?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-can-I-only-show-rows-from-next-6-months-based-on-the/m-p/413693#M73192</link>
      <description>&lt;P&gt;thats correct&lt;/P&gt;</description>
      <pubDate>Mon, 21 May 2018 22:13:12 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-can-I-only-show-rows-from-next-6-months-based-on-the/m-p/413693#M73192</guid>
      <dc:creator>rkassabov</dc:creator>
      <dc:date>2018-05-21T22:13:12Z</dc:date>
    </item>
    <item>
      <title>Re: How can I only show rows from next 6 months based on the datestamp?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-can-I-only-show-rows-from-next-6-months-based-on-the/m-p/413694#M73193</link>
      <description>&lt;P&gt;Just add following before &lt;CODE&gt;|eval month..&lt;/CODE&gt; line:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| where strptime(md_createdAt,"%Y-%m-%d %H:%M:%S.%6N")&amp;gt;now() AND strptime(md_createdAt,"%Y-%m-%d %H:%M:%S.%6N")&amp;lt;=relative_time(now(), "+6mon")
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Mon, 21 May 2018 22:21:16 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-can-I-only-show-rows-from-next-6-months-based-on-the/m-p/413694#M73193</guid>
      <dc:creator>somesoni2</dc:creator>
      <dc:date>2018-05-21T22:21:16Z</dc:date>
    </item>
    <item>
      <title>Re: How can I only show rows from next 6 months based on the datestamp?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-can-I-only-show-rows-from-next-6-months-based-on-the/m-p/413695#M73194</link>
      <description>&lt;P&gt;That worked, thank you!&lt;/P&gt;</description>
      <pubDate>Mon, 21 May 2018 23:24:06 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-can-I-only-show-rows-from-next-6-months-based-on-the/m-p/413695#M73194</guid>
      <dc:creator>rkassabov</dc:creator>
      <dc:date>2018-05-21T23:24:06Z</dc:date>
    </item>
    <item>
      <title>Re: How can I only show rows from next 6 months based on the datestamp?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-can-I-only-show-rows-from-next-6-months-based-on-the/m-p/413696#M73195</link>
      <description>&lt;P&gt;@rkassabov - We have converted the comment to an answer so you can accept it and the question will then show as closed.  You can also (optionally) choose to upvote any comments or answers that you found particularly helpful.  Thanks&lt;/P&gt;</description>
      <pubDate>Tue, 22 May 2018 02:50:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-can-I-only-show-rows-from-next-6-months-based-on-the/m-p/413696#M73195</guid>
      <dc:creator>DalJeanis</dc:creator>
      <dc:date>2018-05-22T02:50:39Z</dc:date>
    </item>
  </channel>
</rss>

