Splunk Search

How can i display dates between two dates?

ajayabburi508
Path Finder

I have a log that has Start date=23/nov/2016 enddate=23/dec/2016.now i need to display the dates between the dates .

Tags (2)

sundareshr
Legend

Try this

... | eval start=strptime(startdate,"%d/%b/%Y") | eval end=strptime(enddate,"%d/%b/%Y") | eval between= mvrange(start, end, "1d") | mvexpand between

ajayabburi508
Path Finder

thanks sundareshr .
but while generating data its missing last date please help me out for that

0 Karma

ajayabburi508
Path Finder

my query like this

|makeresults| eval startdate="01/01/2016", enddate="01/31/2016"| eval start=strptime(startdate,"%m/%d/%Y"), end=strptime(enddate,"%m/%d/%Y")| eval between= mvrange(start, end, "1d") | mvexpand between | eval s=strftime("between","%d-%m-%y") |eval c_time=strftime(between,"%m/%d/%y") | table c_time,start,end,lines,pattern,daysapplicable,type,prirority

0 Karma

sundareshr
Legend

You could add a day to end, like so | eval between= mvrange(start, end+86400, "1d"). Having said that, the other option is to use gentimes, try this

| gentimes start="01/01/2016", end="02/01/2016" increment=1d | rename *human as *time | table *time, lines,pattern,daysapplicable,type,prirority
0 Karma

ajayabburi508
Path Finder

thanks bro

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Dates must be converted into epoch form before they can be compared. Use something like this. It will give the difference between the two dates in seconds.

... | eval eStartDate=strptime(startdate,"%d/%b/%Y") | eval eEndDate=strptime(enddate,"%d/%b/%Y") | eval diff = eEndDate-eStartDate | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...