Query to fetch current month Date ,previous 3 months date and future one month date from indexed data

[Ashwini008]

Hi,

I have around 1000 events in my indexed data. I have to create a DATE dropdown which pulls and shows all the dates of CURRENT MONTH,PREVIOUS 3 MONTHS AND 1 FUTURE MONTH DATE.

How do i write a query for this?

P.S: My Date is not index_time/_time.It is sharepoint data which i am indexing it in splunk

Thanks in Advance! Happy New year!

Query used to fetch DATE field and ProdDate is in yyyy-mm-dd format(2021-01-09)

index = splunk  sourcetype = splunk-sp | spath | fields m:properties_date | rename "m:properties_date" as "ProdDate" | dedup ProdDate | eval temp=split(ProdDate,"T") | eval ProdDate=mvindex(temp, 0) |table ProdDate

[ITWhisperer]

I don't understand our requirement either. Having said that, I think you should dedup last. Also, if you are interested in months rather than dates you could try

index = splunk  sourcetype = splunk-sp
| spath
| rex field=m:properties_date "(?<ProdDate>\d{4}-\d{2})-\d{2}T"
| dedup ProdDate
| table ProdDate

 Do you then need to select current month, 3 months previous and next month from these results? Why can't you just generate these based on now()?

[richgalloway]

I don't understand the problem.  You have a query already.  What are you trying to do that the query doesn't do?

Are you saying your index has data 1 month into the future?  Why?

[Ashwini008]

@woodcock @richgalloway @thambisettyb @ITWhisperer @inventsekar  any suggestions please?

[General_Talos]

If you are building dashboard, I am not sure if you checked details captured by @niketn in below mentioned post.

https://community.splunk.com/t5/Dashboards-Visualizations/Jquery-datepicker-in-splunk/m-p/361049

[Ashwini008]

@General_Talos  I am not using Datepicker. My requirement is to capture the the dates from my field PRODdate(this is not index time/_time).