Splunk Search

Dynamic/multiple earliest and latest in month over month stats/reports in the same search

dearimranz
Engager

I have a following search.

......| dedup field1 | timechart count by date_month limit=10

This gives me monthly counts and I choose earliest and latest from the time picker.

Is it possible to have earliest and latest for each month? For example when I make a monthly stats/count for 2013, is it possible to have the earliest and latest in the following way in the one search?

For January 2013 - earliest=01-01-2013 latest=31-01-2013
For February 2013 - earliest=01-02-2013 latest=31-02-2013
For March 2013 - earliest=01-03-2013 latest=31-03-2013
and so on...

I have also tried

....| dedup field1 | timechart span=mon count(field1)

But it does not give the correct count since dedup command chooses distinct events and ignore some events when time span is "All time" or more than a month.

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

So... you're trying to dedup within each month only? Try this:

... | dedup field1 date_year date_month | timechart span=1mon count

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

So... you're trying to dedup within each month only? Try this:

... | dedup field1 date_year date_month | timechart span=1mon count

dearimranz
Engager

hmmmm, worked perfectly fine. Thanks a lot.

0 Karma

dearimranz
Engager

I changed the question to make it more understandable, can you please check now. I tried timechart span=1mon but it does not give me correct count because dedup command chooses the distinct events and ignore the latest events in some months when search runs for "All time" or more than one month.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Are you possibly looking for timechart span=mon?

0 Karma

Ayn
Legend

Not sure I understand the question, but would this accomplish what you're after?

earliest=-mon@mon latest=@mon

This would grab everything from 00:00 on the 1st of last month until 00:00 on the 1st of this month.

0 Karma

dearimranz
Engager

I changed the question to make it more understandable, can you please check now. I tried timechart span=1mon but it does not give me correct count because dedup command chooses the distinct events and ignore the latest events in some months when search runs for "All time" or more than one month.

0 Karma

Ayn
Legend

Well still not sure I understand your requirements correctly, but timechart?

... | timechart span=1mon...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...