Splunk Search

Month to date for previous month with current month date

Explorer

Hi,

I have to extract the sum of particular search output from my query and the same needs to be compared with previous month to date.
For example, consider today is June 15th, and i have the sum as 150000 for last 15 days, and now i would like to get the same sum for previous month, ie., till May 1-15th using the same query. Could someone suggest on this.

I have tried the eval epoch30daysago=relativetime(now(), "-28d@d" ), but this is not giving the accurate data.

Thanks

Labels (1)
0 Karma
1 Solution

Builder

Per https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/SearchTimeModifiers, try something like this:

index=ndx sourcetype=srctp earliest=-1mon@mon latest=-30d@d 

View solution in original post

Builder

Per https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/SearchTimeModifiers, try something like this:

index=ndx sourcetype=srctp earliest=-1mon@mon latest=-30d@d 

View solution in original post

Explorer

It works with slight modification as below.

-1mon@mon
-30d@day

Builder

you're right! put the @ in the wrong spot 🙂

0 Karma