How to make a continuous date search query?

[mrccasi]

HI everyone, just want to ask if you know how to write this search query continuously?

| search Month>=09 AND Year>=2017

The month should be filtered always starting from September as it is the start of our Fiscal years, however the data is changing monthly so it will throw an error when the year changes to 2018.

[niketn]

@mrccasi, you have two options

Option 1) Create a macro with year and month as input parameters for your base search (you can add other values also as input like index, sourcetype etc)

This will let you control month/year and other base search filters from single place. PS: add time filter to your base search rather than separate pipe with search. The one in your question gets all the data and then filters required. You can instead try the following:

<yourBaseSearch> date_month>9  AND date_year>=2017

Option 2) Run a separate dummy search to get Current Year and pass to the base search filter.
Following is the run anywhere search example. PS: I also am populating earliestTime to be passed to <earliest> parameter of the actual search, so that search filters only the time buckets required

<dashboard>
  <label>Month and Current Year</label>
  <!-- Dummy search populates Year and earliest time -->
  <search>
    <query>| makeresults
| eval Year=strftime(_time,"%Y")
| eval earliestTime=Year."/10/01 00:00:00"
| eval earliestTime=strptime(earliestTime,"%Y/%m/%d %H:%M:%S")</query>
    <done>
      <set token="tokYear">$result.Year$</set>
      <set token="tokEarliestTime">$result.earliestTime$</set>
    </done>
  </search>
  <row>
    <panel>
      <table>
        <search>
          <query>
            index=_internal sourcetype=splunkd log_level!="INFO" date_month>9 date_year>=$tokYear$
            | stats count by date_year date_month
          </query>
          <earliest>$tokEarliestTime$</earliest>
          <latest>now</latest>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">true</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>

[niketn]

@mrccasi, were you able to try any of the options? Is your issue resolved?