How can I get a range of one month since days vary from 30 to 31 days?

[nadxieli]

You can make ranges by months to show it in a drilldown since the days of the months are varied

[woodcock]

Use relative-time specifiers like @mon for the start of this month and @mon+1mon-1day for the end of this month, e.g.:

|makeresults
| eval start=relative_time(now(), "@mon"), end=relative_time(now(), "@mon+1mon-1d")
| convert ctime(*)