Thank you for your help,its working now ... View more

Like this: index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo | eval ago = now() - LastUpdateTime | where ago >= (30 * 60) ... View more

Hi @john.glasscock I am glad you found the answer useful. Do up-vote the answer/comment if it helped 🙂 As per you issue description you need to display Month name using token through an independent search. Please try out the following and use tokPreviousMonth for your dynamic description. <search> <query>| makeresults | eval PreviousMonth=strftime(relative_time(_time,"-1mon@mon"),"%B") </query> <earliest>-1s</earliest> <latest>now</latest> <progress> <set token="tokPreviousMonth">$result.PreviousMonth$</set> </progress> </search> ... View more

Thank you for your guidance.I started Splunk Fundamentals 1.Happy learning 🙂 ... View more