How to generate a report for previous month and have it emailed?

Path Finder

I would like a saved search to be ran on the 1st of each month with data from the previous month and have it emailed to me. I see that under Save As -> Alert, I can choose Scheduled and "Run every month" but where do I I tell it to run the search for the previous month?

0 Karma


Hi bayman,
don't use an alert, use a scheduled report:

  1. run your search using as time period last_month,
  2. save it as a report
  3. schedule this report to be run the 1st of each month
  4. configure an action to send an email


0 Karma

Splunk Employee
Splunk Employee

In you search, you could use earliest and latest. For example:

index=yourindex sourcetype=yoursourcetype earliest=-1mon@mon latest=@mon

You could also set the time selector to Previous Month before saving the Alert.