Splunk Search

How to create n strings for n months?

nick405060
Motivator

I need to create monthly filenames (2018-06-01.csv, 2018-07-01.csv, etc.) for n months. I can do something similar by day with n=30:

| makeresults | eval count=mvrange(0,30,1) | mvexpand count | eval filename=strftime(now()-count\*86400

How do I do this by month, something similar to the below syntax?

| makeresults | eval count=mvrange(0,12,1) | mvexpand count | eval filename=strftime(relative_time(now(), count \* "-1mon")
1 Solution

nick405060
Motivator

Turns out it was pretty easy:

| makeresults | eval count=mvrange(0,12,1) | mvexpand count | eval modifier="-"+tostring(count)+"mon" | eval filename=strftime(relative_time(now(),modifier),"%Y-%m-%d.csv")

View solution in original post

nick405060
Motivator

Turns out it was pretty easy:

| makeresults | eval count=mvrange(0,12,1) | mvexpand count | eval modifier="-"+tostring(count)+"mon" | eval filename=strftime(relative_time(now(),modifier),"%Y-%m-%d.csv")

Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...