How to get data from the first day of the last month to now?
Use snap-to month: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/SearchTimeModifiers#How_to_specify...
View solution in original post
perfect, thank you
Works like a charm, now let me read the article and get better at splunk.
did you try something on time range picker
earliest=-31d latest=now for the months which have 31 days Or earliest=-30d latest=now for the months which have 30 days .
but that will start count in 26/03, i need something to calculate from 01/03 to now (max 01/03 to 30/04, than is 01/04 to 31/05) 2 months of search with the earliest set to the first day of the month.