Listing out dates and appending to search??

[tb5821]

I'm trying to list out all dates between my time picker and have that as a column in my table. I do both things individually but just not together 🙂

index="myindex"
| rex "jobID (?<jobid>\d+)"
| rex "dayID (?<dayid>\d+)"
| eval daydt=strptime(dayid, "%Y%m%d")
| eval daydt=strftime(daydt,"%Y-%m-%d")
| transaction jobid dayid endswith="data consumed for jobID"
|eval duration=tostring(duration,"duration")
| eval status=if(closed_txn=="0","Complete","Incomplete")
| appendpipe
[ |gentimes start=-1|addinfo|eval date=strftime(mvrange(info_min_time,info_max_time,"1d"),"%F")|mvexpand date
]
| sort -date
| table date closed_txn daydt _time duration

Can someone tell me whats wrong here?

[rvany]

What do you exactly mean with "all dates between my time picker"? What is the output of your SPL? What did you expect? Could you give some example data?

[tb5821]

if I select last 30 days - I want one column that has a row for each day regardless of what my main search has

[rvany]

Should this "day column" go on a row of its own? What if you have more than one data rows for a particular day?

Maybe you want to have a look at the "bin" command (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Bin) to group your events by day with a "span=1d" parameter.

[richgalloway]

What should be in that one column? Can you mock it up?