Splunk Search

How to select Year-Month from a search output 3 months ahead ?

promukh
Path Finder

Hello Experts,

I have the below output for a splunk search, i only want to display "Year-Month" rows 3 months ahead of current Year-Month..

YearMonthUpper95(Prediction)
Sep 20205
Oct 202011
Nov 202015
Dec 202018
Jan 202021
Feb 202023
Mar 202026

 

I only want to display  the row - Year-Month -- " Jan 2021  " from the above output  ? 

If the current YearMonth is November-2020 , i want to display the row  -- " Feb 2021 "

Any Help appreciated 

 

Thanks

 

 

Labels (3)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

See this using your example - in your data, I believe you meant to use 2021, not 2020 for Jan/Feb/Mar

| makeresults 
| eval _raw="YearMonth,Upper95(Prediction)
Sep 2020,5
Oct 2020,11
Nov 2020,15
Dec 2020,18
Jan 2021,21
Feb 2021,23
Mar 2021,26"
| multikv forceheader=1
| table YearMonth Upper*
| eval COMMENT="------ YOU WANT FROM THIS LINE BELOW ------"
| eval rowMonth=strptime("01 ".YearMonth, "%d %b %Y")
| eval wantedMonth=relative_time(now(), "+3mon@mon")
| where rowMonth=wantedMonth
| table YearMonth Upper*

Hope this helps

 

promukh
Path Finder

Thank You  , i was able to figure it out using below eval expression 

eval time_select=strftime(relative_time(now(), "+3mon"), "%b %Y") | where YearMonth=time_select

bowesmana
SplunkTrust
SplunkTrust

@promukh 

Your relative time statement should use snap to month, as some dates will not work as expected, for example on 2020-11-30 if you do your solution, it will result in Mar 2021, not Feb 2021 as I expect you need.

So, use @mon

eval time_select=strftime(relative_time(now(), "+3mon@mon"), "%b %Y") 

 to ensure you get Feb 2021

promukh
Path Finder

thank you  @bowesmana  will add the suggested change.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...