I have a report that runs every day and is doing calculations based on the number of days that have occurred so far. After pulling my hair out and using a variety of techniques posted in these forums, I ended up with: | eventstats dc(date_mday) AS daysInMonth Unless i'm mistaken, the date_* fields are automatically generated in splunk (at least all the data i've seen has them) and this was the easiest and most reliable method I found. It looks like if I use the same logic to span across months, I would simply do | eventstats dc(date_mday) AS daysInMonth BY date_month Which when my table spans a couple of months, gives me the count of days for the specific month associated with the _time field and other data for that month.
... View more