Splunk Search

What would be the syntax for the Earliest time modifier to report on data for the last 12 months?

Vijaikanth
Path Finder

Requirement is i need to fetch a Report for the last 12 months.

If today's date is Jun 23, 2015 10:12:20 AM then my

Latest Event = NOW,
Earliest Event = July 1, 2014 00:00:00 AM

What will be the expression i need to use to get that Earliest event?

If i specify "-y" or "-1y@month" it will give June 1, 2014 as Earliest event so usually i get 13 months in the result set (Starting from June 2014 to June 2015 - count 13 months) but any time if the report runs it should give 12 months data in column

0 Karma
1 Solution

srinathd
Contributor

Try earliest=-11mon@mon latest=@d

View solution in original post

0 Karma

srinathd
Contributor

Try earliest=-11mon@mon latest=@d

0 Karma

Vijaikanth
Path Finder

Thanks Srinath. In case if the date is "July 1, 2015" then according to the above answer

earliest = -11mon ==> earliest = "Aug 1, 2014" .

so it will return 11 months right.. or it will return from "July 1, 2014" to "July 1, 2015" ?

0 Karma

srinathd
Contributor

Then use earliest=-12mon@mon latest=@mon or @d based on your need.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...