I would like a saved search to be ran on the 1st of each month with data from the previous month and have it emailed to me. I see that under Save As -> Alert, I can choose Scheduled and "Run every month" but where do I I tell it to run the search for the previous month?
Hi bayman,
don't use an alert, use a scheduled report:
Bye.
Giuseppe
In you search, you could use earliest and latest. For example:
index=yourindex sourcetype=yoursourcetype earliest=-1mon@mon latest=@mon
You could also set the time selector to Previous Month before saving the Alert.