How to generate a report for previous month and have it emailed?

[bayman]

I would like a saved search to be ran on the 1st of each month with data from the previous month and have it emailed to me. I see that under Save As -> Alert, I can choose Scheduled and "Run every month" but where do I I tell it to run the search for the previous month?

[gcusello]

Hi bayman,
don't use an alert, use a scheduled report:

1. run your search using as time period last_month,
2. save it as a report
3. schedule this report to be run the 1st of each month
4. configure an action to send an email

Bye.
Giuseppe

[kmorris_splunk]

In you search, you could use earliest and latest. For example:

index=yourindex sourcetype=yoursourcetype earliest=-1mon@mon latest=@mon

You could also set the time selector to Previous Month before saving the Alert.