Getting Data In

How can I determine the last date of an epoch time?

tamduong16
Contributor

So for the dashboard time dropdown, I want to determine whether the To: date that user select is the last date of that month. Could I do that with today Splunk? If not, can I determine the last date of that month base on the epoch time?

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

There are a number of ways to do that. Here's one simple method. Add one day to the epoch time, and translate to "day". If the answer is 01, then today is the last day of that month.

| makeresults 
| eval curdate="2016-02-28 2017-02-28 2017-03-28 2017-03-31" 
| makemv curdate 
| mvexpand curdate
| eval curdateEpoch=strptime(curdate,"%Y-%m-%d") 
| eval daytest=strftime(curdateEpoch+86400,"%d") 
| eval flag=case(daytest="01","last day of month")

tamduong16
Contributor

@DalJeanis, how can I do this in xml do you know? This is my xml:

  <label>Select a time range:</label>
  <default>
    <earliest>-1mon@mon</earliest>
    <latest>@mon</latest>
  </default>
  <change>
      <eval token="timelineearliest">case($field1.earliest$ = </eval>
      <eval token="timelinelatest">$field1.latest$</eval>
    </change>
</input>

I want to find that out and put that for timelineearliest line. Is this durable? Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...