Splunk Search

How get data for yesterday, last month on that day, and last year on that day

kuul13
Explorer

I want o create a dashboard for my API response times and TPS for comparison between multiple timeframes. When ever someone open the dashboard, I want to show a bar chart for yesterday, last month on the same day, and last year on the same day.

Example: 11/24/2025 (yesterday), 10/24/2025 (last month), and 11/24/2024 (last year)

I tried using the following but last month and year doesn't give the correct datetime range:

  • Yesterday: earliest=`-1d@d latest=@d`. << 11/24/2025
  • Same Day Last Month: earliest=`-30d@d latest=-29d@d`. << 11/26/2025
  • Same Day Last Year: earliest=`-365d@d latest=-364d@d`.<< 11/25/2025

How can I add an accurate date filter based on when this report is run, 28 day month, 29 day month, 30 day month or 31 day month. I want time range to be more dynamic and automatic.

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

I'd go for  strptime/strftime manipulation.

Did you consider border cases however? How about days like Dec 31st? What would be "last month, same day"? There is no Nov 31st. How about "last year" from Feb 29th on a leap year?

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...