Other Usage

How to report on a specific date to a specific date per month?

duneclarke2
Explorer

I am trying to generate/send a report that shows results from the 28th of the previous month to the 28th of the current month automatically, without using the time picker.

Any help appreciated!

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this.

<<your base search>> earliest=-1mon@mon+28d latest=@mon+28d

The earliest option goes back one month from today then jumps to the beginning of the month and adds 28 days.  The latest option jumps to the beginning of the current month then adds 28 days.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

duneclarke2
Explorer

Thanks that did the trick! Sent Karma! 

richgalloway
SplunkTrust
SplunkTrust

Try this.

<<your base search>> earliest=-1mon@mon+28d latest=@mon+28d

The earliest option goes back one month from today then jumps to the beginning of the month and adds 28 days.  The latest option jumps to the beginning of the current month then adds 28 days.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Simplifying the Analyst Experience with Finding-based Detections

    Splunk invites you to an engaging Tech Talk focused on streamlining security operations with ...

[Puzzles] Solve, Learn, Repeat: Word Search

This challenge was first posted on Slack #puzzles channelThis puzzle is based on a letter grid containing ...

[Puzzles] Solve, Learn, Repeat: Advent of Code - Day 4

Advent of CodeIn order to participate in these challenges, you will need to register with the Advent of Code ...