Splunk Search

How to generate a Month-Year Series with 3 months interval ?

promukh
Path Finder

Hello Experts,

I need to generate a series of values in the form of Year-Month to part of the drop down list in the Panel

I was trying the below but it only generates the data for 1 Month 

|makeresults  | eval month = strftime(relative_time(now(), "+3mon@mon"), "%B %Y")  | return $month

Jan 2021

 

Expected Ouput :

Jan 2021

April 2021

JULY 2021

 

 

 

 

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this

| makeresults 
| eval month = strftime(relative_time(now(),"@mon"), "%B %Y"), month2 = strftime(relative_time(now(),"-1mon@mon"), "%B %Y"), month3 = strftime(relative_time(now(),"-2mon@mon"), "%B %Y") 
| eval month=mvappend(month3,month2,month)
| mvexpand month
| fields + month | fields - _time
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...