<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How do you display the last 4 months in Splunk starting from the current month? in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-do-you-display-the-last-4-months-in-Splunk-starting-from-the/m-p/431195#M173323</link>
    <description>&lt;P&gt;@sbhatnagar88 ,&lt;/P&gt;

&lt;P&gt;Try&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; |makeresults
 |eval months=strftime(mvrange(relative_time(_time,"-3mon@mon"),relative_time(_time,"@mon+1"),"1mon"),"%B %Y")
 |mvexpand months
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Detailed/expanded version &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;|makeresults
|eval earliest=relative_time(_time,"-3mon@mon") 
|eval latest=relative_time(_time,"@mon+1")
|eval months=mvrange(earliest,latest,"1mon")
|eval months=strftime(months,"%B %Y")
|mvexpand months|table months
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Tue, 29 Jan 2019 14:23:39 GMT</pubDate>
    <dc:creator>renjith_nair</dc:creator>
    <dc:date>2019-01-29T14:23:39Z</dc:date>
    <item>
      <title>How do you display the last 4 months in Splunk starting from the current month?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-you-display-the-last-4-months-in-Splunk-starting-from-the/m-p/431194#M173322</link>
      <description>&lt;P&gt;How do you display the last 4 months in Splunk starting from the current month?&lt;/P&gt;

&lt;P&gt;Required output is:&lt;/P&gt;

&lt;P&gt;January 2019&lt;BR /&gt;
December 2018&lt;BR /&gt;
November 2018&lt;BR /&gt;
October 2018&lt;/P&gt;</description>
      <pubDate>Tue, 29 Jan 2019 11:29:06 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-you-display-the-last-4-months-in-Splunk-starting-from-the/m-p/431194#M173322</guid>
      <dc:creator>sbhatnagar88</dc:creator>
      <dc:date>2019-01-29T11:29:06Z</dc:date>
    </item>
    <item>
      <title>Re: How do you display the last 4 months in Splunk starting from the current month?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-you-display-the-last-4-months-in-Splunk-starting-from-the/m-p/431195#M173323</link>
      <description>&lt;P&gt;@sbhatnagar88 ,&lt;/P&gt;

&lt;P&gt;Try&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; |makeresults
 |eval months=strftime(mvrange(relative_time(_time,"-3mon@mon"),relative_time(_time,"@mon+1"),"1mon"),"%B %Y")
 |mvexpand months
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Detailed/expanded version &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;|makeresults
|eval earliest=relative_time(_time,"-3mon@mon") 
|eval latest=relative_time(_time,"@mon+1")
|eval months=mvrange(earliest,latest,"1mon")
|eval months=strftime(months,"%B %Y")
|mvexpand months|table months
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Tue, 29 Jan 2019 14:23:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-you-display-the-last-4-months-in-Splunk-starting-from-the/m-p/431195#M173323</guid>
      <dc:creator>renjith_nair</dc:creator>
      <dc:date>2019-01-29T14:23:39Z</dc:date>
    </item>
    <item>
      <title>Re: How do you display the last 4 months in Splunk starting from the current month?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-you-display-the-last-4-months-in-Splunk-starting-from-the/m-p/431196#M173324</link>
      <description>&lt;P&gt;I believe you need to change the maximum amount of results your query can display before you can do this. Unless you're talking about the actual syntax query. &lt;/P&gt;

&lt;P&gt;Are you talking about the query or about not being able to see 4 months of data? &lt;/P&gt;</description>
      <pubDate>Tue, 29 Jan 2019 14:53:11 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-you-display-the-last-4-months-in-Splunk-starting-from-the/m-p/431196#M173324</guid>
      <dc:creator>ryhluc01</dc:creator>
      <dc:date>2019-01-29T14:53:11Z</dc:date>
    </item>
    <item>
      <title>Re: How do you display the last 4 months in Splunk starting from the current month?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-you-display-the-last-4-months-in-Splunk-starting-from-the/m-p/431197#M173325</link>
      <description>&lt;P&gt;Great!! that works absolutely fine...thanks for help!!!&lt;/P&gt;</description>
      <pubDate>Wed, 30 Jan 2019 05:26:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-you-display-the-last-4-months-in-Splunk-starting-from-the/m-p/431197#M173325</guid>
      <dc:creator>sbhatnagar88</dc:creator>
      <dc:date>2019-01-30T05:26:49Z</dc:date>
    </item>
    <item>
      <title>Re: How do you display the last 4 months in Splunk starting from the current month?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-you-display-the-last-4-months-in-Splunk-starting-from-the/m-p/431198#M173326</link>
      <description>&lt;P&gt;@sbhatnagar88 If your problem is resolved, please accept an answer to help future readers.&lt;/P&gt;</description>
      <pubDate>Wed, 30 Jan 2019 12:32:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-you-display-the-last-4-months-in-Splunk-starting-from-the/m-p/431198#M173326</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2019-01-30T12:32:22Z</dc:date>
    </item>
    <item>
      <title>Re: How do you display the last 4 months in Splunk starting from the current month?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-you-display-the-last-4-months-in-Splunk-starting-from-the/m-p/431199#M173327</link>
      <description>&lt;P&gt;@sbhatnagar88 , if it helped, please accept as answer&lt;/P&gt;</description>
      <pubDate>Sun, 03 Feb 2019 02:55:28 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-you-display-the-last-4-months-in-Splunk-starting-from-the/m-p/431199#M173327</guid>
      <dc:creator>renjith_nair</dc:creator>
      <dc:date>2019-02-03T02:55:28Z</dc:date>
    </item>
    <item>
      <title>Re: How do you display the last 4 months in Splunk starting from the current month?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-you-display-the-last-4-months-in-Splunk-starting-from-the/m-p/431200#M173328</link>
      <description>&lt;P&gt;Thanks much!! Problem has been solved...&lt;/P&gt;</description>
      <pubDate>Fri, 08 Feb 2019 05:49:06 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-you-display-the-last-4-months-in-Splunk-starting-from-the/m-p/431200#M173328</guid>
      <dc:creator>sbhatnagar88</dc:creator>
      <dc:date>2019-02-08T05:49:06Z</dc:date>
    </item>
  </channel>
</rss>

