Splunk Enterprise

Unable to generate time interval into multi value field

jiaminyun
Path Finder

My requirement is that my start time is January 1, 2024 and end time is January 7, 2024. In addition to placing the start and end times in multi value fields, please also include each date in this time interval, such as January 2, 2024, January 3, 2024, January 4, 2024, January 5, 2024, January 6, 2024. The final field content should be January 1, 2024, January 2, 2024, January 3, 2024, January 4, 2024, January 5, 2024, January 6, 2024, and July.
The SPL statement is as follows:

| makeresults
| eval start_date = "2024-01-01", end_date = "2024-01-07"
| eval start_timestamp = strptime(start_date, "%Y-%m-%d")
| eval end_timestamp = strptime(end_date, "%Y-%m-%d")
| eval num_days = round((end_timestamp - start_timestamp) / 86400)
| eval range = mvrange(1, num_days)
| eval intermediate_dates = strftime(relative_time(start_timestamp, "+".tostring(range)."days"), "%Y-%m-%d")
| eval all_dates = mvappend(start_date, intermediate_dates)
| eval all_dates = mvappend(all_dates, end_date)
| fields all_dates
Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval start_date = "2024-01-01", end_date = "2024-01-07"
| eval start_timestamp = strptime(start_date, "%Y-%m-%d")
| eval end_timestamp = strptime(end_date, "%Y-%m-%d")
| eval num_days = round((end_timestamp - start_timestamp) / 86400)
| eval all_dates = start_date
| eval range = mvrange(1, num_days + 1)
| foreach mode=multivalue range
    [| eval all_dates=mvappend(all_dates,strftime(relative_time(start_timestamp,"+".<<ITEM>>."d"),"%Y-%m-%d"))]
| fields all_dates

jiaminyun
Path Finder

Thank you for your response, it has solved my problem!

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...