Splunk Search

How to create n strings for n months?

nick405060
Motivator

I need to create monthly filenames (2018-06-01.csv, 2018-07-01.csv, etc.) for n months. I can do something similar by day with n=30:

| makeresults | eval count=mvrange(0,30,1) | mvexpand count | eval filename=strftime(now()-count\*86400

How do I do this by month, something similar to the below syntax?

| makeresults | eval count=mvrange(0,12,1) | mvexpand count | eval filename=strftime(relative_time(now(), count \* "-1mon")
1 Solution

nick405060
Motivator

Turns out it was pretty easy:

| makeresults | eval count=mvrange(0,12,1) | mvexpand count | eval modifier="-"+tostring(count)+"mon" | eval filename=strftime(relative_time(now(),modifier),"%Y-%m-%d.csv")

View solution in original post

nick405060
Motivator

Turns out it was pretty easy:

| makeresults | eval count=mvrange(0,12,1) | mvexpand count | eval modifier="-"+tostring(count)+"mon" | eval filename=strftime(relative_time(now(),modifier),"%Y-%m-%d.csv")

Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...