Splunk Search

How to dynamically pass the current and last month in search?

avni26
Explorer

Hi,

I have field as Jan , Feb ,Mar .... Dec with values for each month and I want to take sum of current month and last month.
I was truing to first check the current month and last month using eval like below and this eval gives me the current month name(Jul) , last month as Jun

eval curr_mon=strftime(now(), "%b")

eval last_mon= strftime(relative_time(now(),"-mon"),"%b")

Now I have field names
Name     id            Jan Feb Mar Jul Jun Aug
xyz      123A         10    20  20    25   30   15
ABC    145B          20    15  30   25   30    20

Want to take sum of current month and last month field with stats, I tried like below but got no results;

stats sum('curr_mon') as current_total sum('last_mon') as last_total 

I want this search to automatically show the current month's sum, and not using a static value in the stats sum expression.

Please suggest.

Labels (3)
0 Karma

to4kawa
Ultra Champion
| makeresults
| eval _raw="Name,id,Jan,Feb,Mar,Jul,Jun,Aug
xyz,123A,10,20,20,25,30,15
ABC,145B,20,15,30,25,30,20"
| multikv forceheader=1
| table Name,id,Jan,Feb,Mar,Jul,Jun,Aug
| rename COMMENT as "this is sample"
| rename Name as _Name , id as _id
| stats sum(*) as *
| eval tmp=1
| untable tmp month sums
| eval cur_mon=strftime(now(),"%b") ,last_mon=strftime(relative_time(now(),"-1mon"),"%b")
| eval current_total=if(month=cur_mon,sums,NULL), last_total=if(month=last_mon,sums,NULL)
| stats values(current_total) as current_total values(last_total) as last_total
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...