set earliest and latest time stamp

[k_harini]

How to set earliest to 26th of previous month and latest to 25th of current month? if hard corded then 26th of Feb to 25th of March is the cycle. Please help with some examples. Thanks!

[k_harini]

Thanks everyone for prompt response. This forum helps a lot.

[muebel · Accepted solution]

Hi k_harini, Including something like this into your search should set the time interval as you want:

earliest=-1mon@mon+26d latest=@mon+25d

You might have to adjust it a bit, but the basic idea is to look at the previous month, relative to the start of this month, -1mon@mon and then add 26 days to it, +26d

Likewise, the latest time should be from the start of the current month @mon to 25 days into the month +25d

You might need to adjust the day values to get exactly what you want, but this should do the trick.

Please let me know if this answers your question! 😄

[woodcock]

Like this:

... earliest=-1mon@mon+26d latest=@mon+25d

https://docs.splunk.com/Documentation/Splunk/6.5.2/Search/Specifytimemodifiersinyoursearch

[somesoni2]

I guess there is a typo in latest (you meant 25 and not 245).

[woodcock]

HA HA, yes! Fixed now, thank you.