Splunk Search

Search Within Results To Show Only Last Month

andrewkenth
Communicator

I have 3 searches that I'm appending. Each returns a Name and Date. Then I take the maximum of each of the Dates and show it.
Now I'd like to show only those that have a Date in the last month. How can I do this? earliest does not seem to be working, likely because I may be stripping the _time off when I turn it into a stats table (not sure..?).

If I do individual earliest or use the time picker it limits the entire search, which I do not want to do.

Any advice?

Basiclaly I'm taking the append results and doing a

| stats max(Date) as Date by LogonName

I tried

| stats max(Date) as Date by LogonName | Search earliest=-28d

but did not get the resutls I'm expecting (no results!)

Any advice guys and gals?

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If your date is an epoch timestamp you can do this:

... | where Date < relative_time(now(), "@mon")

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

If your date is an epoch timestamp you can do this:

... | where Date < relative_time(now(), "@mon")

michael3
Explorer

more than 10 years later, and this is still helping people.  Thanks Martin!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The @mon will throw you back to the 1st of this month, so it'll only leave through Date values less than that. It pretty much depends on how you define "last month" 🙂

Could be the previous 31 days with no snapping to month boundaries as you use now, or all of April as I assumed.

0 Karma

andrewkenth
Communicator

That did not work but it put me on the right path. I'm not sure if it's @mon that isn't' working or what but this works:

| where Date > relative_time(now(), "-31d@d")

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...