Splunk Search

Month to date for previous month with current month date

prakashmca05
Explorer

Hi,

I have to extract the sum of particular search output from my query and the same needs to be compared with previous month to date.
For example, consider today is June 15th, and i have the sum as 150000 for last 15 days, and now i would like to get the same sum for previous month, ie., till May 1-15th using the same query. Could someone suggest on this.

I have tried the eval epoch30days_ago=relative_time(now(), "-28d@d" ), but this is not giving the accurate data.

Thanks

Labels (1)
0 Karma
1 Solution

wmyersas
Builder

Per https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/SearchTimeModifiers, try something like this:

index=ndx sourcetype=srctp earliest=-1mon@mon latest=-30d@d 

View solution in original post

wmyersas
Builder

Per https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/SearchTimeModifiers, try something like this:

index=ndx sourcetype=srctp earliest=-1mon@mon latest=-30d@d 

prakashmca05
Explorer

It works with slight modification as below.

-1mon@mon
-30d@day

wmyersas
Builder

you're right! put the @ in the wrong spot 🙂

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...