Splunk Search

Hi everyone, can someone please tl how can we set up a report where we are fetching last 6 month period

New Member

for ex: if i am running the report on 5th of may, i will need the data from 1st of November till 30 apri and i l need to run this report every month for last 6 months , m on 6.x

how can i set this report so that whenever we run the report for the last months period, it does not include current month..Thank you.

0 Karma


To start 6 months ago, use earliest=-6mon@mon. To end at the beginning of the current month, use latest=@mon.

If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!