Splunk Enterprise

How to restrict particular month data?

Keerthi
Path Finder

hi, have a qn  in the below query

| makeresults count=730
| streamstats count
| eval _time=_time-(count*86400)
| timechart Count as Timestamp span=1mon
| join type=left _time [| savedsearch XYZ
| eval today = strftime(relative_time(now(), "@d"), "%Y-%m-%d %H:%M:%S.%N")
| where like (APP_NAME ,"Managed iMAP Application") and like (BS_ID,"%") and like (Function,"%") and like (DEPARTMENT_LONG_NAME,"%") and like (COUNTRY,"%") and like(EMPLOYEE_TYPE,"%") and STATUS="active"
| eval _time = strptime(FROM_DATE, "%Y-%m-%d %H:%M:%S.%N")
| eval _time!= "2023-07"
| timechart Count as Created span=1mon
| streamstats sum(Created) as Createdcumulative]
| join type=left _time
[| savedsearch XYZ
| where like (APP_NAME ,"Managed iMAP Application") and like (BS_ID,"%") and like (Function,"%") and like (DEPARTMENT_LONG_NAME,"%") and like (COUNTRY,"%") and like(EMPLOYEE_TYPE,"%") and STATUS="inactive"
| eval _time = strptime(TO_DATE, "%Y-%m-%d %H:%M:%S.%N")
| timechart Count as Deactivated span=1mon
| streamstats sum(Deactivated) as Deactivatedcumulative]
| eval Active = Createdcumulative
| eval Deactivated = Deactivatedcumulative
| where _time>=relative_time(now(),"-1y@d")

| fields - Createdcumulative, Deactivatedcumulative, Timestamp




the below query fetches me the results below:

Keerthi_0-1689941634204.png

 i need to restrict the data till the previous month and not show current month. can anyone help me with modifying the query pls

Labels (1)
0 Karma

cklunck
Path Finder

What if you change line 4 to:

| timechart Count as Timestamp span=1mon partial=f

 

This will drop the data from the "partial" data set for the current month, and will only display months that have a complete set of data.

Note that this will also remove a "partial" month at the beginning of the dataset, if one exists. You might need to extend your time range back a bit farther to account for that.

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...