Splunk Enterprise

Unable to generate time interval into multi value field

jiaminyun
Path Finder

My requirement is that my start time is January 1, 2024 and end time is January 7, 2024. In addition to placing the start and end times in multi value fields, please also include each date in this time interval, such as January 2, 2024, January 3, 2024, January 4, 2024, January 5, 2024, January 6, 2024. The final field content should be January 1, 2024, January 2, 2024, January 3, 2024, January 4, 2024, January 5, 2024, January 6, 2024, and July.
The SPL statement is as follows:

| makeresults
| eval start_date = "2024-01-01", end_date = "2024-01-07"
| eval start_timestamp = strptime(start_date, "%Y-%m-%d")
| eval end_timestamp = strptime(end_date, "%Y-%m-%d")
| eval num_days = round((end_timestamp - start_timestamp) / 86400)
| eval range = mvrange(1, num_days)
| eval intermediate_dates = strftime(relative_time(start_timestamp, "+".tostring(range)."days"), "%Y-%m-%d")
| eval all_dates = mvappend(start_date, intermediate_dates)
| eval all_dates = mvappend(all_dates, end_date)
| fields all_dates
Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval start_date = "2024-01-01", end_date = "2024-01-07"
| eval start_timestamp = strptime(start_date, "%Y-%m-%d")
| eval end_timestamp = strptime(end_date, "%Y-%m-%d")
| eval num_days = round((end_timestamp - start_timestamp) / 86400)
| eval all_dates = start_date
| eval range = mvrange(1, num_days + 1)
| foreach mode=multivalue range
    [| eval all_dates=mvappend(all_dates,strftime(relative_time(start_timestamp,"+".<<ITEM>>."d"),"%Y-%m-%d"))]
| fields all_dates

jiaminyun
Path Finder

Thank you for your response, it has solved my problem!

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...