Splunk Search

Search Within Results To Show Only Last Month

andrewkenth
Communicator

I have 3 searches that I'm appending. Each returns a Name and Date. Then I take the maximum of each of the Dates and show it.
Now I'd like to show only those that have a Date in the last month. How can I do this? earliest does not seem to be working, likely because I may be stripping the _time off when I turn it into a stats table (not sure..?).

If I do individual earliest or use the time picker it limits the entire search, which I do not want to do.

Any advice?

Basiclaly I'm taking the append results and doing a

| stats max(Date) as Date by LogonName

I tried

| stats max(Date) as Date by LogonName | Search earliest=-28d

but did not get the resutls I'm expecting (no results!)

Any advice guys and gals?

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If your date is an epoch timestamp you can do this:

... | where Date < relative_time(now(), "@mon")

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If your date is an epoch timestamp you can do this:

... | where Date < relative_time(now(), "@mon")
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The @mon will throw you back to the 1st of this month, so it'll only leave through Date values less than that. It pretty much depends on how you define "last month" 🙂

Could be the previous 31 days with no snapping to month boundaries as you use now, or all of April as I assumed.

0 Karma

andrewkenth
Communicator

That did not work but it put me on the right path. I'm not sure if it's @mon that isn't' working or what but this works:

| where Date > relative_time(now(), "-31d@d")

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...