https://community.splunk.com/t5/Splunk-Search/How-to-timechart-the-count-of-assets-per-month-based-on-a-range/m-p/229782#M68070 <P>In my data, I have a list of assets that occur with a "First Found" date as well as a "Last Found" date. I need to generate a timechart so that each asset is counted for the months that they are "active" (eg anything between the first/last found dates). </P> <PRE><CODE>asset first_found last_found Host1 01/01/2016 05/01/2016 Host2 03/15/2016 04/01/2016 Host3 02/10/2016 05/01/2016 Host4 05/01/2016 06/26/2016 Host5 03/01/2016 </CODE></PRE> <P>What I'm looking for using the sample data above is a timechart count by month of each asset that occurred during that month. For January, the count would be 1 (Host1), February would be 2 (Host1, Host2), March would be 4 (Host1, Host2, Host3, Host5), etc. Some events will not have the last_found date which means they are still active and should be counted up to and including the current month. Any help would be appreciated. </P> Mon, 27 Jun 2016 18:24:23 GMT john_dagostino 2016-06-27T18:24:23Z https://community.splunk.com/t5/Splunk-Search/How-to-timechart-the-count-of-assets-per-month-based-on-a-range/m-p/229782#M68070 <P>In my data, I have a list of assets that occur with a "First Found" date as well as a "Last Found" date. I need to generate a timechart so that each asset is counted for the months that they are "active" (eg anything between the first/last found dates). </P> <PRE><CODE>asset first_found last_found Host1 01/01/2016 05/01/2016 Host2 03/15/2016 04/01/2016 Host3 02/10/2016 05/01/2016 Host4 05/01/2016 06/26/2016 Host5 03/01/2016 </CODE></PRE> <P>What I'm looking for using the sample data above is a timechart count by month of each asset that occurred during that month. For January, the count would be 1 (Host1), February would be 2 (Host1, Host2), March would be 4 (Host1, Host2, Host3, Host5), etc. Some events will not have the last_found date which means they are still active and should be counted up to and including the current month. Any help would be appreciated. </P> Mon, 27 Jun 2016 18:24:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-timechart-the-count-of-assets-per-month-based-on-a-range/m-p/229782#M68070 john_dagostino 2016-06-27T18:24:23Z https://community.splunk.com/t5/Splunk-Search/How-to-timechart-the-count-of-assets-per-month-based-on-a-range/m-p/229783#M68071 <P>Try this</P> <PRE><CODE>your base search | eval first_found=strptime(first_found, "%m/%d/%Y") | eval last_found=strptime(last_found, "%m/%d/%Y") | eval last_found=if(isnull(last_found), now(), last_found) | eval range=mvrange(first_found, last_found, "1mon") | mvexpand range | eval range=strftime(range, "%m-%b") | chart count over range by asset | addtotals </CODE></PRE> Mon, 27 Jun 2016 23:22:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-timechart-the-count-of-assets-per-month-based-on-a-range/m-p/229783#M68071 sundareshr 2016-06-27T23:22:00Z https://community.splunk.com/t5/Splunk-Search/How-to-timechart-the-count-of-assets-per-month-based-on-a-range/m-p/229784#M68072 <P>Thank you, I was able to get a modified version of this to work.</P> Tue, 28 Jun 2016 16:44:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-timechart-the-count-of-assets-per-month-based-on-a-range/m-p/229784#M68072 john_dagostino 2016-06-28T16:44:11Z