Extract data between multiple days..

[Inayath_khan]

Hi Guys,

I am just trying to write a spluNk query to extract data between 1-32 days , >32 days , > 42 days , > 72 days , < 365 days and < 720 days

I tried multiple queries and I believe it's possible with the case statement . Kindly suggest on this.

Note : I just have one custom field acd_date which I should use in my case statement.

Thanks in advance

[to4kawa]

| makeresults count=2 
| streamstats count 
| eval _time=if(count=2,relative_time(_time,(-1*count)."y@y"),_time) 
| makecontinuous span=1d _time 
| timechart count span=1d
| eval diff=tostring(now() - _time,"duration")
| rex field=diff "(?<daysAgo>\d+)\+"
| fillnull daysAgo
| eval acd_date=case(daysAgo <= 32 ,"less32days" , daysAgo <= 42, "less42days",  daysAgo <= 72,"less72days" , daysAgo <= 365,"less1year", daysAgo <= 720,"less2years",true(), "over2years")
| dedup acd_date

It's all about order.

[richgalloway · Accepted solution]

Perhaps this will get you started. It produces a 'period' field that you should be able to use for other purposes.

index=foo earliest=-720d latest=now
| eval epoch = strptime (acd_date, "<format of the acd_date field>")
| eval period = case(epoch < relative_time(now(), "-32d"), "1-32", epoch < relative_time(now(), "-42d"), ">32",
epoch < relative_time(now(), "-72d"), ">42", epoch < relative_time(now(), "-365d"), "<365", 1==1, "<720")
| ...