topic Re: How can i display dates between two dates? in Splunk Search

How can i display dates between two dates?

ajayabburi508 — Wed, 23 Nov 2016 07:55:12 GMT

I have a log that has Start date=23/nov/2016 enddate=23/dec/2016.now i need to display the dates between the dates .

Re: How can i display dates between two dates?

richgalloway — Wed, 23 Nov 2016 13:03:15 GMT

Dates must be converted into epoch form before they can be compared. Use something like this. It will give the difference between the two dates in seconds.

... | eval eStartDate=strptime(startdate,"%d/%b/%Y") | eval eEndDate=strptime(enddate,"%d/%b/%Y") | eval diff = eEndDate-eStartDate | ...

Re: How can i display dates between two dates?

sundareshr — Wed, 23 Nov 2016 14:14:53 GMT

Try this

... | eval start=strptime(startdate,"%d/%b/%Y") | eval end=strptime(enddate,"%d/%b/%Y") | eval between= mvrange(start, end, "1d") | mvexpand between

Re: How can i display dates between two dates?

ajayabburi508 — Thu, 24 Nov 2016 12:53:20 GMT

thanks sundareshr .
but while generating data its missing last date please help me out for that

Re: How can i display dates between two dates?

ajayabburi508 — Tue, 29 Sep 2020 11:55:21 GMT

my query like this

|makeresults| eval startdate="01/01/2016", enddate="01/31/2016"| eval start=strptime(startdate,"%m/%d/%Y"), end=strptime(enddate,"%m/%d/%Y")| eval between= mvrange(start, end, "1d") | mvexpand between | eval s=strftime("between","%d-%m-%y") |eval c_time=strftime(between,"%m/%d/%y") | table c_time,start,end,lines,pattern,daysapplicable,type,prirority

Re: How can i display dates between two dates?

sundareshr — Thu, 24 Nov 2016 13:22:26 GMT

You could add a day to end, like so | eval between= mvrange(start, end+86400, "1d"). Having said that, the other option is to use gentimes, try this

| gentimes start="01/01/2016", end="02/01/2016" increment=1d | rename *human as *time | table *time, lines,pattern,daysapplicable,type,prirority

Re: How can i display dates between two dates?

ajayabburi508 — Fri, 25 Nov 2016 06:11:43 GMT

thanks bro