Search Within Results To Show Only Last Month

[andrewkenth]

I have 3 searches that I'm appending. Each returns a Name and Date. Then I take the maximum of each of the Dates and show it.
Now I'd like to show only those that have a Date in the last month. How can I do this? earliest does not seem to be working, likely because I may be stripping the _time off when I turn it into a stats table (not sure..?).

If I do individual earliest or use the time picker it limits the entire search, which I do not want to do.

Any advice?

Basiclaly I'm taking the append results and doing a

| stats max(Date) as Date by LogonName

I tried

| stats max(Date) as Date by LogonName | Search earliest=-28d

but did not get the resutls I'm expecting (no results!)

Any advice guys and gals?

[martin_mueller · Accepted solution]

If your date is an epoch timestamp you can do this:

... | where Date < relative_time(now(), "@mon")

[martin_mueller]

The @mon will throw you back to the 1st of this month, so it'll only leave through Date values less than that. It pretty much depends on how you define "last month" 🙂

Could be the previous 31 days with no snapping to month boundaries as you use now, or all of April as I assumed.

[andrewkenth]

That did not work but it put me on the right path. I'm not sure if it's @mon that isn't' working or what but this works:

| where Date > relative_time(now(), "-31d@d")