Splunk Enterprise

How to restrict particular month data?

Keerthi
Path Finder

hi, have a qn  in the below query

| makeresults count=730
| streamstats count
| eval _time=_time-(count*86400)
| timechart Count as Timestamp span=1mon
| join type=left _time [| savedsearch XYZ
| eval today = strftime(relative_time(now(), "@d"), "%Y-%m-%d %H:%M:%S.%N")
| where like (APP_NAME ,"Managed iMAP Application") and like (BS_ID,"%") and like (Function,"%") and like (DEPARTMENT_LONG_NAME,"%") and like (COUNTRY,"%") and like(EMPLOYEE_TYPE,"%") and STATUS="active"
| eval _time = strptime(FROM_DATE, "%Y-%m-%d %H:%M:%S.%N")
| eval _time!= "2023-07"
| timechart Count as Created span=1mon
| streamstats sum(Created) as Createdcumulative]
| join type=left _time
[| savedsearch XYZ
| where like (APP_NAME ,"Managed iMAP Application") and like (BS_ID,"%") and like (Function,"%") and like (DEPARTMENT_LONG_NAME,"%") and like (COUNTRY,"%") and like(EMPLOYEE_TYPE,"%") and STATUS="inactive"
| eval _time = strptime(TO_DATE, "%Y-%m-%d %H:%M:%S.%N")
| timechart Count as Deactivated span=1mon
| streamstats sum(Deactivated) as Deactivatedcumulative]
| eval Active = Createdcumulative
| eval Deactivated = Deactivatedcumulative
| where _time>=relative_time(now(),"-1y@d")

| fields - Createdcumulative, Deactivatedcumulative, Timestamp




the below query fetches me the results below:

Keerthi_0-1689941634204.png

 i need to restrict the data till the previous month and not show current month. can anyone help me with modifying the query pls

Labels (1)
0 Karma

cklunck
Path Finder

What if you change line 4 to:

| timechart Count as Timestamp span=1mon partial=f

 

This will drop the data from the "partial" data set for the current month, and will only display months that have a complete set of data.

Note that this will also remove a "partial" month at the beginning of the dataset, if one exists. You might need to extend your time range back a bit farther to account for that.

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...