How to get data from the first day of the last month to now?

[felipesewaybric]

How to get data from the first day of the last month to now?

[the_wolverine · Accepted solution]

Use snap-to month: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/SearchTimeModifiers#How_to_specify...

earliest=-1mon@mon
latest=now

[felipesewaybric]

perfect, thank you

Works like a charm, now let me read the article and get better at splunk.

thanks again.

[juvetm]

did you try something on time range picker

[ngatchasandra]

Hi feli,

Try with;

earliest=-31d latest=now for the months which have 31 days Or earliest=-30d latest=now for the months which have 30 days .

[felipesewaybric]

but that will start count in 26/03, i need something to calculate from 01/03 to now (max 01/03 to 30/04, than is 01/04 to 31/05) 2 months of search with the earliest set to the first day of the month.