Splunk Search

Month to date for previous month with current month date

prakashmca05
Explorer

Hi,

I have to extract the sum of particular search output from my query and the same needs to be compared with previous month to date.
For example, consider today is June 15th, and i have the sum as 150000 for last 15 days, and now i would like to get the same sum for previous month, ie., till May 1-15th using the same query. Could someone suggest on this.

I have tried the eval epoch30days_ago=relative_time(now(), "-28d@d" ), but this is not giving the accurate data.

Thanks

Labels (1)
0 Karma
1 Solution

wmyersas
Builder

Per https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/SearchTimeModifiers, try something like this:

index=ndx sourcetype=srctp earliest=-1mon@mon latest=-30d@d 

View solution in original post

wmyersas
Builder

Per https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/SearchTimeModifiers, try something like this:

index=ndx sourcetype=srctp earliest=-1mon@mon latest=-30d@d 

prakashmca05
Explorer

It works with slight modification as below.

-1mon@mon
-30d@day

wmyersas
Builder

you're right! put the @ in the wrong spot 🙂

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...