Splunk Search

SPL - Creating a list using two time stamp entries

jacobmcn67
New Member

jacobmcn67_0-1618812184184.png

Hi all,

 

I am trying to create a fourth column which would display all values between a given time range in the single cell. For the screenshot provided this would mean a cell in the fourth column containing:
10:00

11:00

12:00

 

I am not sure how to do this without using a loop.

 

Thanks

Jacob

Labels (1)
0 Karma

manjunathmeti
Champion

hi @jacobmcn67,

You can use mvrange function which creates a multivalue field with a range of numbers between X and Y, incrementing by Z.

 

| makeresults 
| eval start="11:00", end="14:00"
| eval st="04/19/2021 ".start, et="04/19/2021 ".end 
| eval st=strptime(st, "%m/%d/%Y %H:%M"), et=strptime(et, "%m/%d/%Y %H:%M")
| eval mv=mvrange(st,et,"1h"), mv=strftime(mv, "%H:%M")
| table start, end, mv

 

Here 04/19/2021 is some date used just to convert start and end to the epoch values. It is a constant and you don't need to change it.

If this reply helps you, a like would be appreciated.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.