Hello Experts,
I have the below output for a splunk search, i only want to display "Year-Month" rows 3 months ahead of current Year-Month..
YearMonth | Upper95(Prediction) |
Sep 2020 | 5 |
Oct 2020 | 11 |
Nov 2020 | 15 |
Dec 2020 | 18 |
Jan 2020 | 21 |
Feb 2020 | 23 |
Mar 2020 | 26 |
I only want to display the row - Year-Month -- " Jan 2021 " from the above output ?
If the current YearMonth is November-2020 , i want to display the row -- " Feb 2021 "
Any Help appreciated
Thanks
See this using your example - in your data, I believe you meant to use 2021, not 2020 for Jan/Feb/Mar
| makeresults
| eval _raw="YearMonth,Upper95(Prediction)
Sep 2020,5
Oct 2020,11
Nov 2020,15
Dec 2020,18
Jan 2021,21
Feb 2021,23
Mar 2021,26"
| multikv forceheader=1
| table YearMonth Upper*
| eval COMMENT="------ YOU WANT FROM THIS LINE BELOW ------"
| eval rowMonth=strptime("01 ".YearMonth, "%d %b %Y")
| eval wantedMonth=relative_time(now(), "+3mon@mon")
| where rowMonth=wantedMonth
| table YearMonth Upper*
Hope this helps
Thank You , i was able to figure it out using below eval expression
eval time_select=strftime(relative_time(now(), "+3mon"), "%b %Y") | where YearMonth=time_select
Your relative time statement should use snap to month, as some dates will not work as expected, for example on 2020-11-30 if you do your solution, it will result in Mar 2021, not Feb 2021 as I expect you need.
So, use @mon
eval time_select=strftime(relative_time(now(), "+3mon@mon"), "%b %Y")
to ensure you get Feb 2021
thank you @bowesmana will add the suggested change.