Splunk Search

How to expand the dates between two dates?

Sankar_g30
Loves-to-Learn

I want to display the date between two date range EX. 3/11 -3/19

Field : SDate= 3/11/2018 EDate=3/19/2018

I need the output as 3/11 , 3/12, 3/13.....3/19.

Tags (1)
0 Karma

javiergn
Super Champion

@Sankar_g30 please do not forget to accept an answer if you are happy with it

0 Karma

mayurr98
Super Champion

hey try this run anywhere search

| makeresults 
| eval SDate="3/11/2018",EDate="3/19/2018" 
| rex field=SDate "(?<sdate>\d+\/\d+)" 
| rex field=EDate "(?<edate>\d+\/\d+)"

In your environment, you should write

<your_base_Search> | rex field=SDate "(?<sdate>\d+\/\d+)" | rex field=EDate "(?<edate>\d+\/\d+)"

let me know if this helps!

0 Karma

javiergn
Super Champion

Hi,

Use gentimes for that:

| gentimes start=3/11/2018 end=3/19/2018 increment=1d
| eval dates = strftime(starttime, "%m/%d")
| table dates

Output:

alt text

If you want to get rid of the leading zeros I can show you how to do that too.

Regards,
J

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...