Hello!, First time posting here. Just started learning Splunk and I am trying to extract events between two date ranges 4/6/2021 and 4/7/2021.
I tried one of the earlier suggested answers which were SS_2.png SS_1.png
index="security"
| eval Date="04/07/2021"
| eval timestampDate=strptime(Date, "%m/%d/%Y")
| eval timestampStart=strptime("04/06/2021", "%m/%d/%Y")
| eval timestampEnd=strptime("04/07/2021", "%m/%d/%Y")
| eval formattedTimestamp = strftime(timestamp,"%Y-%m-%dT%H:%M:%S")
| where timestampDate >= timestampStart AND timestampDate <= timestampEnd
and
index="security" | eval Date="4/7/2021" | where (strptime(Date, "%m/%d/%Y")>=strptime("4/6/2021", "%m/%d/%Y")) AND (strptime(Date, "%m/%d/%Y")<=strptime("4/7/2021", "%m/%d/%Y"))
But the queries return all the events available in the log file. Attaching the screenshots here.
Here the sample from the index.
Sample_event.png
Can someone please assist, thanks in advance.
... View more