Splunk Search

How to get Date Range per month?

Path Finder

I need to get the no. of days per month in my data. But in my data there is 2 fields for Date which is Start Date and End Date.
Ex. Start Date: October 15, 2017
End Date: February 10, 2018

I need to get the no. of days per months in above example.
I tried to used the mvrange to get the range between the 2 fields and mvcount to get the no. of days but the result I'm getting total range of the data starting october to february.

Is there a way I can get it?

0 Karma
1 Solution

Super Champion

Try this run anywhere search:

|makeresults|eval Start Date="October 15, 2017", End Date="February 10, 2018"|eval Start Date=strptime('Start Date',"%B %d, %Y"),End Date=strptime('End Date',"%B %d, %Y")| eval days=round(('End Date'-'Start Date')/86400)

strptime('Start Date',"%B %d, %Y") should give you seconds since Jan 1st 1970.
Hope this helps!

View solution in original post

0 Karma

Super Champion

Try this run anywhere search:

|makeresults|eval Start Date="October 15, 2017", End Date="February 10, 2018"|eval Start Date=strptime('Start Date',"%B %d, %Y"),End Date=strptime('End Date',"%B %d, %Y")| eval days=round(('End Date'-'Start Date')/86400)

strptime('Start Date',"%B %d, %Y") should give you seconds since Jan 1st 1970.
Hope this helps!

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!