Splunk Search

Listing out dates and appending to search??

Communicator

I'm trying to list out all dates between my time picker and have that as a column in my table. I do both things individually but just not together 🙂

index="myindex"
| rex "jobID (?<jobid>\d+)"
| rex "dayID (?<dayid>\d+)"
| eval daydt=strptime(dayid, "%Y%m%d")
| eval daydt=strftime(daydt,"%Y-%m-%d")
| transaction jobid dayid endswith="data consumed for jobID"
|eval duration=tostring(duration,"duration")
| eval status=if(closed_txn=="0","Complete","Incomplete")
| appendpipe
[ |gentimes start=-1|addinfo|eval date=strftime(mvrange(info_min_time,info_max_time,"1d"),"%F")|mvexpand date
]
| sort -date
| table date closed_txn daydt _time duration

 

Can someone tell me whats wrong here?

Labels (3)
0 Karma

Communicator

What do you exactly mean with "all dates between my time picker"? What is the output of your SPL? What did you expect? Could you give some example data?

0 Karma

Communicator

if I select last 30 days - I want one column that has a row for each day regardless of what my main search has

 

0 Karma

Communicator

Should this "day column" go on a row of its own? What if you have more than one data rows for a particular day?

Maybe you want to have a look at the "bin" command (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Bin) to group your events by day with a "span=1d" parameter.

0 Karma

SplunkTrust
SplunkTrust
What should be in that one column? Can you mock it up?
---
If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!