Data reports are only 10 months long and reports with same month in 2 years

[kelly6453]

When I ask for a report that is longer than 10 months, the last month in the report (say November) disappears when the 1st month (in this case January) appears. I set the correct parameters (i.e. - All-Time or Jan 1 - Nov 30) still the last month always disappears after having shown me the stats while loading the report.

Also, what code do you use to ask Splunk to give you stats in the same report from Oct 2011, 2012 and 2013? It can't differentiate the years. Suggestions?

Thank you

[jtrucks]

Could you be more specific as to what search you ran to get your broken results?

To answer your second question, you can do specify date_month=10 and a date range of the three years spanning your search range. Another approach is to do three subsearches each with only the range of october for a single year specified like:

earliest="10/1/2011:00:00:00" latest="10/31/2011:00:00:00" your search here [search earliest="10/1/2012:00:00:00" latest="10/31/2012:00:00:00" your search here] [search earliest="10/1/2013:00:00:00" latest="10/31/2013:00:00:00" your search here]