Archive
Highlighted

set earliest and latest time stamp

Communicator

How to set earliest to 26th of previous month and latest to 25th of current month? if hard corded then 26th of Feb to 25th of March is the cycle. Please help with some examples. Thanks!

Tags (1)
0 Karma
Highlighted

Re: set earliest and latest time stamp

Esteemed Legend
0 Karma
Highlighted

Re: set earliest and latest time stamp

SplunkTrust
SplunkTrust

I guess there is a typo in latest (you meant 25 and not 245).

Highlighted

Re: set earliest and latest time stamp

Esteemed Legend

HA HA, yes! Fixed now, thank you.

0 Karma
Highlighted

Re: set earliest and latest time stamp

SplunkTrust
SplunkTrust

Hi k_harini, Including something like this into your search should set the time interval as you want:

earliest=-1mon@mon+26d latest=@mon+25d

You might have to adjust it a bit, but the basic idea is to look at the previous month, relative to the start of this month, -1mon@mon and then add 26 days to it, +26d

Likewise, the latest time should be from the start of the current month @mon to 25 days into the month +25d

You might need to adjust the day values to get exactly what you want, but this should do the trick.

Please let me know if this answers your question! 😄

View solution in original post

Highlighted

Re: set earliest and latest time stamp

Communicator

Thanks everyone for prompt response. This forum helps a lot.

0 Karma