How can I restrict Splunk to search only for first day of every month for last 6 months?

[PickleRick]

There are at least three different approaches. Each has its drawbacks.

One is that you search for date_mday=1. The downside to this method is that the field may not be set for all events and if there were any time (especially timezone) conversions applied to the events during indexing process this field might not be accurate (you might get events from late hours of day before or early hours of next day).

Another idea is that you eval with strftime to auxiliary field rendering only day of the month and then limit your results to those that have value of 1. Unfortunately - for this you have to process all your events for whole 6 months only to return some 1/30th of them. It's very inefficient and not feasible for large data sets.

And final possibility would be to either directly specify (earliest=x latest=y) OR (earliest=x latest=aa) [...] set of conditions (relatively ok for 6 periods) or use subsearch to generate them.

[rk1165]

I am using the third option but for that also query times out for only 2 periods. I am not sure why though because effectively we are only searching for 6 days. If I search for the same event for last 7-8 days it works fine.

[PickleRick]

Are you sure you're grouping the earliest/latest conditions properly?

[rk1165]

This is how I am grouping

(earliest=05/01/2022:00:00:00 latest=05/01/2022:23:59:59) OR (earliest=06/01/2022:00:00:00 latest=06/01/2022:23:59:59)

Please let me know if this is fine.

[PickleRick]

Looks OK but I don't trust the time specifiers and I'd try something like

(earliest=@mon latest=@mon+1d) OR (earliest=-1mon@mon latest=-1mon@mon+1d)

[rk1165]

I first tried that way only but it ended up giving some results from a day before also. So, I tried fixing the exact dates to no avail.

[PickleRick]

Question is what do you mean by "from a day before". I mean - do you mean _time values or the raw values within an event.