Splunk Enterprise

Unable to generate time interval into multi value field

jiaminyun
Path Finder

My requirement is that my start time is January 1, 2024 and end time is January 7, 2024. In addition to placing the start and end times in multi value fields, please also include each date in this time interval, such as January 2, 2024, January 3, 2024, January 4, 2024, January 5, 2024, January 6, 2024. The final field content should be January 1, 2024, January 2, 2024, January 3, 2024, January 4, 2024, January 5, 2024, January 6, 2024, and July.
The SPL statement is as follows:

| makeresults
| eval start_date = "2024-01-01", end_date = "2024-01-07"
| eval start_timestamp = strptime(start_date, "%Y-%m-%d")
| eval end_timestamp = strptime(end_date, "%Y-%m-%d")
| eval num_days = round((end_timestamp - start_timestamp) / 86400)
| eval range = mvrange(1, num_days)
| eval intermediate_dates = strftime(relative_time(start_timestamp, "+".tostring(range)."days"), "%Y-%m-%d")
| eval all_dates = mvappend(start_date, intermediate_dates)
| eval all_dates = mvappend(all_dates, end_date)
| fields all_dates
Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval start_date = "2024-01-01", end_date = "2024-01-07"
| eval start_timestamp = strptime(start_date, "%Y-%m-%d")
| eval end_timestamp = strptime(end_date, "%Y-%m-%d")
| eval num_days = round((end_timestamp - start_timestamp) / 86400)
| eval all_dates = start_date
| eval range = mvrange(1, num_days + 1)
| foreach mode=multivalue range
    [| eval all_dates=mvappend(all_dates,strftime(relative_time(start_timestamp,"+".<<ITEM>>."d"),"%Y-%m-%d"))]
| fields all_dates

jiaminyun
Path Finder

Thank you for your response, it has solved my problem!

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...