Splunk Search

How to create n strings for n months?

nick405060
Motivator

I need to create monthly filenames (2018-06-01.csv, 2018-07-01.csv, etc.) for n months. I can do something similar by day with n=30:

| makeresults | eval count=mvrange(0,30,1) | mvexpand count | eval filename=strftime(now()-count\*86400

How do I do this by month, something similar to the below syntax?

| makeresults | eval count=mvrange(0,12,1) | mvexpand count | eval filename=strftime(relative_time(now(), count \* "-1mon")
1 Solution

nick405060
Motivator

Turns out it was pretty easy:

| makeresults | eval count=mvrange(0,12,1) | mvexpand count | eval modifier="-"+tostring(count)+"mon" | eval filename=strftime(relative_time(now(),modifier),"%Y-%m-%d.csv")

View solution in original post

nick405060
Motivator

Turns out it was pretty easy:

| makeresults | eval count=mvrange(0,12,1) | mvexpand count | eval modifier="-"+tostring(count)+"mon" | eval filename=strftime(relative_time(now(),modifier),"%Y-%m-%d.csv")

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.