topic Re: Data reports are only 10 months long and reports with same month in 2 years in Splunk Search

Data reports are only 10 months long and reports with same month in 2 years

kelly6453 — Mon, 11 Nov 2013 20:41:21 GMT

When I ask for a report that is longer than 10 months, the last month in the report (say November) disappears when the 1st month (in this case January) appears. I set the correct parameters (i.e. - All-Time or Jan 1 - Nov 30) still the last month always disappears after having shown me the stats while loading the report.

Also, what code do you use to ask Splunk to give you stats in the same report from Oct 2011, 2012 and 2013? It can't differentiate the years. Suggestions?

Thank you

Re: Data reports are only 10 months long and reports with same month in 2 years

jtrucks — Mon, 11 Nov 2013 23:37:09 GMT

Could you be more specific as to what search you ran to get your broken results?

To answer your second question, you can do specify date_month=10 and a date range of the three years spanning your search range. Another approach is to do three subsearches each with only the range of october for a single year specified like:

earliest="10/1/2011:00:00:00" latest="10/31/2011:00:00:00" your search here [search earliest="10/1/2012:00:00:00" latest="10/31/2012:00:00:00" your search here] [search earliest="10/1/2013:00:00:00" latest="10/31/2013:00:00:00" your search here]