topic Re: How do I create a timechart by month, but starting with the 15th day of the month? (15th - 14th) in Splunk Search

How do I create a timechart by month, but starting with the 15th day of the month? (15th - 14th)

markgandolfo — Mon, 01 Feb 2016 08:38:30 GMT

Hi,

I'm trying to timechart by month, but starting at the 15th of the month. I've looked for "offsets", but I can't seem to find anything helpful.

Can someone point me in the correct direction?

Thanks
Mark

Re: How do I create a timechart by month, but starting with the 15th day of the month? (15th - 14th)

chimell — Mon, 01 Feb 2016 08:57:50 GMT

Hi
try this example and tell if it help you

 index=_internal  |timechart count by date_month where (date_mday>=15 and date_mday=<31)

Re: How do I create a timechart by month, but starting with the 15th day of the month? (15th - 14th)

javiergn — Mon, 01 Feb 2016 10:15:16 GMT

This is what I've tried and seems to be working fine but I've only got two months worth of data so ...

index=_internal
| eval mytime = if(date_mday<=15, _time, _time+(15*24*60*60))
| bucket mytime span=1mon
| eval month = strftime(mytime, "%B")
| chart count over mytime by month
| eval mytime = "Mid-" . strftime(mytime, "%B")

Re: How do I create a timechart by month, but starting with the 15th day of the month? (15th - 14th)

fdi01 — Tue, 29 Sep 2020 08:37:29 GMT

try like :

your_base_search ... date_mday>=15| timechart span=1months count

example:

index = _internal date_mday>=15| timechart span=1months count