Splunk Search

What would be the syntax for the Earliest time modifier to report on data for the last 12 months?

Vijaikanth
Path Finder

Requirement is i need to fetch a Report for the last 12 months.

If today's date is Jun 23, 2015 10:12:20 AM then my

Latest Event = NOW,
Earliest Event = July 1, 2014 00:00:00 AM

What will be the expression i need to use to get that Earliest event?

If i specify "-y" or "-1y@month" it will give June 1, 2014 as Earliest event so usually i get 13 months in the result set (Starting from June 2014 to June 2015 - count 13 months) but any time if the report runs it should give 12 months data in column

0 Karma
1 Solution

srinathd
Contributor

Try earliest=-11mon@mon latest=@d

View solution in original post

0 Karma

srinathd
Contributor

Try earliest=-11mon@mon latest=@d

0 Karma

Vijaikanth
Path Finder

Thanks Srinath. In case if the date is "July 1, 2015" then according to the above answer

earliest = -11mon ==> earliest = "Aug 1, 2014" .

so it will return 11 months right.. or it will return from "July 1, 2014" to "July 1, 2015" ?

0 Karma

srinathd
Contributor

Then use earliest=-12mon@mon latest=@mon or @d based on your need.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...