Hi,
I have around 1000 events in my indexed data. I have to create a DATE dropdown which pulls and shows all the dates of CURRENT MONTH,PREVIOUS 3 MONTHS AND 1 FUTURE MONTH DATE.
How do i write a query for this?
P.S: My Date is not index_time/_time.It is sharepoint data which i am indexing it in splunk
Thanks in Advance! Happy New year!
Query used to fetch DATE field and ProdDate is in yyyy-mm-dd format(2021-01-09)
index = splunk sourcetype = splunk-sp | spath | fields m:properties_date | rename "m:properties_date" as "ProdDate" | dedup ProdDate | eval temp=split(ProdDate,"T") | eval ProdDate=mvindex(temp, 0) |table ProdDate
I don't understand our requirement either. Having said that, I think you should dedup last. Also, if you are interested in months rather than dates you could try
index = splunk sourcetype = splunk-sp
| spath
| rex field=m:properties_date "(?<ProdDate>\d{4}-\d{2})-\d{2}T"
| dedup ProdDate
| table ProdDate
Do you then need to select current month, 3 months previous and next month from these results? Why can't you just generate these based on now()?
I don't understand the problem. You have a query already. What are you trying to do that the query doesn't do?
Are you saying your index has data 1 month into the future? Why?
@woodcock @richgalloway @thambisettyb @ITWhisperer @inventsekar any suggestions please?
If you are building dashboard, I am not sure if you checked details captured by @niketn in below mentioned post.
https://community.splunk.com/t5/Dashboards-Visualizations/Jquery-datepicker-in-splunk/m-p/361049
@General_Talos I am not using Datepicker. My requirement is to capture the the dates from my field PRODdate(this is not index time/_time).