Reporting

Get events of first day of each month

ajaykr
New Member

Hi,

We have a report generating data on first day of each month and also on first day of each week.

We need to get the data of first day of each month. We have the query as below
|eval assetCount=tonumber(substr(Message,42))| eval month = strftime(_time, "%m") |stats max(assetCount) as "Total Count" by month|sort month desc
But, this gives the last data of each month.

Can you please help in getting the first data of each month. That is the report generated on the first day of each month.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...