How to generate a report for previous month and have it emailed?

Path Finder

I would like a saved search to be ran on the 1st of each month with data from the previous month and have it emailed to me. I see that under Save As -> Alert, I can choose Scheduled and "Run every month" but where do I I tell it to run the search for the previous month?

0 Karma


Hi bayman,
don't use an alert, use a scheduled report:

  1. run your search using as time period last_month,
  2. save it as a report
  3. schedule this report to be run the 1st of each month
  4. configure an action to send an email


0 Karma

Splunk Employee
Splunk Employee

In you search, you could use earliest and latest. For example:

index=yourindex sourcetype=yoursourcetype earliest=-1mon@mon latest=@mon

You could also set the time selector to Previous Month before saving the Alert.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...