Hello!, First time posting here. Just started learning Splunk and I am trying to extract events between two date ranges 4/6/2021 and 4/7/2021.
I tried one of the earlier suggested answers which were
index="security"
| eval Date="04/07/2021"
| eval timestampDate=strptime(Date, "%m/%d/%Y")
| eval timestampStart=strptime("04/06/2021", "%m/%d/%Y")
| eval timestampEnd=strptime("04/07/2021", "%m/%d/%Y")
| eval formattedTimestamp = strftime(timestamp,"%Y-%m-%dT%H:%M:%S")
| where timestampDate >= timestampStart AND timestampDate <= timestampEnd
and
index="security" | eval Date="4/7/2021" | where (strptime(Date, "%m/%d/%Y")>=strptime("4/6/2021", "%m/%d/%Y")) AND (strptime(Date, "%m/%d/%Y")<=strptime("4/7/2021", "%m/%d/%Y"))
But the queries return all the events available in the log file. Attaching the screenshots here.
Here the sample from the index.
Can someone please assist, thanks in advance.
... View more