How to select Year-Month from a search output 3 months ahead ?

[promukh]

Hello Experts,

I have the below output for a splunk search, i only want to display "Year-Month" rows 3 months ahead of current Year-Month..

YearMonth	Upper95(Prediction)
Sep 2020	5
Oct 2020	11
Nov 2020	15
Dec 2020	18
Jan 2020	21
Feb 2020	23
Mar 2020	26

I only want to display  the row - Year-Month -- " Jan 2021  " from the above output  ? 

If the current YearMonth is November-2020 , i want to display the row  -- " Feb 2021 "

Any Help appreciated 

Thanks

[bowesmana]

See this using your example - in your data, I believe you meant to use 2021, not 2020 for Jan/Feb/Mar

| makeresults 
| eval _raw="YearMonth,Upper95(Prediction)
Sep 2020,5
Oct 2020,11
Nov 2020,15
Dec 2020,18
Jan 2021,21
Feb 2021,23
Mar 2021,26"
| multikv forceheader=1
| table YearMonth Upper*
| eval COMMENT="------ YOU WANT FROM THIS LINE BELOW ------"
| eval rowMonth=strptime("01 ".YearMonth, "%d %b %Y")
| eval wantedMonth=relative_time(now(), "+3mon@mon")
| where rowMonth=wantedMonth
| table YearMonth Upper*

Hope this helps

[promukh]

Thank You  , i was able to figure it out using below eval expression 

eval time_select=strftime(relative_time(now(), "+3mon"), "%b %Y") | where YearMonth=time_select

[bowesmana]

@promukh 

Your relative time statement should use snap to month, as some dates will not work as expected, for example on 2020-11-30 if you do your solution, it will result in Mar 2021, not Feb 2021 as I expect you need.

So, use @mon

eval time_select=strftime(relative_time(now(), "+3mon@mon"), "%b %Y") 

 to ensure you get Feb 2021

[promukh]

thank you  @bowesmana  will add the suggested change.