topic Re: Month to date for previous month with current month date in Splunk Search

Month to date for previous month with current month date

prakashmca05 — Wed, 30 Sep 2020 05:36:13 GMT

Hi,

I have to extract the sum of particular search output from my query and the same needs to be compared with previous month to date.
For example, consider today is June 15th, and i have the sum as 150000 for last 15 days, and now i would like to get the same sum for previous month, ie., till May 1-15th using the same query. Could someone suggest on this.

I have tried the eval epoch30days_ago=relative_time(now(), "-28d@d" ), but this is not giving the accurate data.

Thanks

Re: Month to date for previous month with current month date

wmyersas — Mon, 01 Jun 2020 15:17:05 GMT

Per https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/SearchTimeModifiers, try something like this:

index=ndx sourcetype=srctp earliest=-1mon@mon latest=-30d@d

Re: Month to date for previous month with current month date

prakashmca05 — Thu, 04 Jun 2020 15:33:33 GMT

It works with slight modification as below.

-1mon@mon
-30d@day

Re: Month to date for previous month with current month date

wmyersas — Thu, 04 Jun 2020 16:59:12 GMT

you're right! put the @ in the wrong spot 🙂