topic Re: How to expand the dates between two dates? in Splunk Search

How to expand the dates between two dates?

Sankar_g30 — Thu, 22 Mar 2018 08:22:17 GMT

I want to display the date between two date range EX. 3/11 -3/19

Field : SDate= 3/11/2018 EDate=3/19/2018

I need the output as 3/11 , 3/12, 3/13.....3/19.

javiergn — Thu, 22 Mar 2018 08:32:41 GMT

Hi,

Use gentimes for that:

| gentimes start=3/11/2018 end=3/19/2018 increment=1d
| eval dates = strftime(starttime, "%m/%d")
| table dates

Output:

If you want to get rid of the leading zeros I can show you how to do that too.

Regards,
J

mayurr98 — Thu, 22 Mar 2018 09:37:30 GMT

hey try this run anywhere search

| makeresults 
| eval SDate="3/11/2018",EDate="3/19/2018" 
| rex field=SDate "(?<sdate>\d+\/\d+)" 
| rex field=EDate "(?<edate>\d+\/\d+)"

In your environment, you should write

<your_base_Search> | rex field=SDate "(?<sdate>\d+\/\d+)" | rex field=EDate "(?<edate>\d+\/\d+)"

let me know if this helps!

javiergn — Tue, 29 May 2018 10:07:35 GMT

@Sankar_g30 please do not forget to accept an answer if you are happy with it