topic Re: financial Calendar in Splunk Dev

financial Calendar

DanielaEstera — Thu, 23 Sep 2021 10:12:49 GMT

Hi, community members

I am trying to write a query that looks like this:

| dbxquery query="select VULNERABILITY_LIFECYCLE, SOURCE, CLOSURE_FY, CLOSURE_QUARTER, CLOSURE_DATE
from table [...]"
| eval MONTH=strftime(strptime(CLOSURE_DATE,"%Y-%m-%d %H:%M:%S"),"%m")
| eval SURSA = if(SOURCE!="QUALYS-P","Confirmed", "Potential")
| chart count over MONTH by SURSA

My problem is that I want this chart to represent a financial year, not a calendar year. How can I do this? (also, without skipping months)

Thank you for your support,

Daniela

Re: financial Calendar

ITWhisperer — Thu, 23 Sep 2021 12:41:07 GMT

Include the year in the MONTH field? Add 8/subtract 4 (assuming April) and take a modulus 12 and add 1?

Re: financial Calendar

DanielaEstera — Thu, 23 Sep 2021 15:22:23 GMT

not quite sure. did you mean :

| eval MONTH=strftime(strptime(CLOSURE_DATE,"%Y-%m-%d %H:%M:%S"),"%m-%Y")
| eval luna = (MONTH + 4 )mod 12 + 1

Re: financial Calendar

ITWhisperer — Thu, 23 Sep 2021 15:56:40 GMT

The values will be sorted so year should come before month.

| eval MONTH=strftime(strptime(CLOSURE_DATE,"%Y-%m-%d %H:%M:%S"),"%Y-%m")

or change the month so the April is 1 and March is 12

| eval luna = ((MONTH + 8 ) % 12) + 1