Getting Data In

How can I only show rows from next 6 months based on the datestamp?

rkassabov
Path Finder

I am trying to only show records that have "md_createdAt" fields that occur in the next 6 months, looking forward from that day's date. How would I only show these records?

|`init("xxx")`
| eval month=strftime(strptime(md_createdAt,"%Y-%m-%d %H:%M:%S.%6N"),"%b")
| table info_subType md_createdAt month
| chart count(info_subType) over month by md_createdAt
Tags (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Just add following before |eval month.. line:

| where strptime(md_createdAt,"%Y-%m-%d %H:%M:%S.%6N")>now() AND strptime(md_createdAt,"%Y-%m-%d %H:%M:%S.%6N")<=relative_time(now(), "+6mon")

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Just add following before |eval month.. line:

| where strptime(md_createdAt,"%Y-%m-%d %H:%M:%S.%6N")>now() AND strptime(md_createdAt,"%Y-%m-%d %H:%M:%S.%6N")<=relative_time(now(), "+6mon")

rkassabov
Path Finder

That worked, thank you!

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

@rkassabov - We have converted the comment to an answer so you can accept it and the question will then show as closed. You can also (optionally) choose to upvote any comments or answers that you found particularly helpful. Thanks

0 Karma

somesoni2
SplunkTrust
SplunkTrust

md_createdAt should be 6 month in future from today's date?

0 Karma

rkassabov
Path Finder

thats correct

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...