Getting Data In

How can I determine the last date of an epoch time?

tamduong16
Contributor

So for the dashboard time dropdown, I want to determine whether the To: date that user select is the last date of that month. Could I do that with today Splunk? If not, can I determine the last date of that month base on the epoch time?

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

There are a number of ways to do that. Here's one simple method. Add one day to the epoch time, and translate to "day". If the answer is 01, then today is the last day of that month.

| makeresults 
| eval curdate="2016-02-28 2017-02-28 2017-03-28 2017-03-31" 
| makemv curdate 
| mvexpand curdate
| eval curdateEpoch=strptime(curdate,"%Y-%m-%d") 
| eval daytest=strftime(curdateEpoch+86400,"%d") 
| eval flag=case(daytest="01","last day of month")

tamduong16
Contributor

@DalJeanis, how can I do this in xml do you know? This is my xml:

  <label>Select a time range:</label>
  <default>
    <earliest>-1mon@mon</earliest>
    <latest>@mon</latest>
  </default>
  <change>
      <eval token="timelineearliest">case($field1.earliest$ = </eval>
      <eval token="timelinelatest">$field1.latest$</eval>
    </change>
</input>

I want to find that out and put that for timelineearliest line. Is this durable? Thanks!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...