https://community.splunk.com/t5/Splunk-Search/How-to-show-data-in-a-range-grouped-by-specified-time-period/m-p/324544#M96821 <P>not knowing if you want 5 or 15 days yet, i have written this:<BR /> | eval earliest=relative_time(_time,"@mon-16d@d") |eval latest=relative_time(earliest,"+15d@d")|eval time=strftime(earliest,"%y-%m-%d")+" - "+strftime(latest,"%y-%m-%d")<BR /> and you can use <STRONG>time</STRONG> as the field to bucket by. you can adjust the values in the relative_time evals to meet your needs, if you really want only 5 days. these will bring you "17-08-16 - 17-08-31" for example. </P> Tue, 29 Sep 2020 15:39:24 GMT cmerriman 2020-09-29T15:39:24Z https://community.splunk.com/t5/Splunk-Search/How-to-show-data-in-a-range-grouped-by-specified-time-period/m-p/324542#M96819 <P>i have below data. i want to represent in a range to group date for 5 days and i want date field to represent(16-08-16 - 16-08-30) count. pls help</P> <PRE><CODE> date count 16-08-26 14 16-08-27 4 16-08-28 14 16-08-29 30 16-08-30 34 16-08-31 30 16-09-01 6 16-09-02 4 </CODE></PRE> Wed, 06 Sep 2017 12:03:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-show-data-in-a-range-grouped-by-specified-time-period/m-p/324542#M96819 DataOrg 2017-09-06T12:03:46Z https://community.splunk.com/t5/Splunk-Search/How-to-show-data-in-a-range-grouped-by-specified-time-period/m-p/324543#M96820 <P>do you mean 16-08-26 - 16-08-30 for a 5 day span or 16-08-16 - 16-08-30 for a 15 day span?</P> Wed, 06 Sep 2017 12:10:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-show-data-in-a-range-grouped-by-specified-time-period/m-p/324543#M96820 cmerriman 2017-09-06T12:10:47Z https://community.splunk.com/t5/Splunk-Search/How-to-show-data-in-a-range-grouped-by-specified-time-period/m-p/324544#M96821 <P>not knowing if you want 5 or 15 days yet, i have written this:<BR /> | eval earliest=relative_time(_time,"@mon-16d@d") |eval latest=relative_time(earliest,"+15d@d")|eval time=strftime(earliest,"%y-%m-%d")+" - "+strftime(latest,"%y-%m-%d")<BR /> and you can use <STRONG>time</STRONG> as the field to bucket by. you can adjust the values in the relative_time evals to meet your needs, if you really want only 5 days. these will bring you "17-08-16 - 17-08-31" for example. </P> Tue, 29 Sep 2020 15:39:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-show-data-in-a-range-grouped-by-specified-time-period/m-p/324544#M96821 cmerriman 2020-09-29T15:39:24Z https://community.splunk.com/t5/Splunk-Search/How-to-show-data-in-a-range-grouped-by-specified-time-period/m-p/324545#M96822 <P>5 days span</P> Wed, 06 Sep 2017 12:36:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-show-data-in-a-range-grouped-by-specified-time-period/m-p/324545#M96822 DataOrg 2017-09-06T12:36:14Z https://community.splunk.com/t5/Splunk-Search/How-to-show-data-in-a-range-grouped-by-specified-time-period/m-p/324546#M96823 <P>Thanks. worked perfectly !</P> Wed, 06 Sep 2017 12:41:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-show-data-in-a-range-grouped-by-specified-time-period/m-p/324546#M96823 DataOrg 2017-09-06T12:41:53Z https://community.splunk.com/t5/Splunk-Search/How-to-show-data-in-a-range-grouped-by-specified-time-period/m-p/324547#M96824 <P>Awesome, i'm glad, just make sure to spot check that the counts all match! I'm sure you already did, but i just like to double check when doing aggregates!</P> Wed, 06 Sep 2017 12:45:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-show-data-in-a-range-grouped-by-specified-time-period/m-p/324547#M96824 cmerriman 2017-09-06T12:45:41Z