Other Usage

How to report on a specific date to a specific date per month?

duneclarke2
Explorer

I am trying to generate/send a report that shows results from the 28th of the previous month to the 28th of the current month automatically, without using the time picker.

Any help appreciated!

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this.

<<your base search>> earliest=-1mon@mon+28d latest=@mon+28d

The earliest option goes back one month from today then jumps to the beginning of the month and adds 28 days.  The latest option jumps to the beginning of the current month then adds 28 days.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

duneclarke2
Explorer

Thanks that did the trick! Sent Karma! 

richgalloway
SplunkTrust
SplunkTrust

Try this.

<<your base search>> earliest=-1mon@mon+28d latest=@mon+28d

The earliest option goes back one month from today then jumps to the beginning of the month and adds 28 days.  The latest option jumps to the beginning of the current month then adds 28 days.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...