Compare previous month total at the same day as current day

[BernardEAI]

Hi

I would like to generate a count for the current month to date (today), and compare this with the count of the previous month, to the same day. So for instance, the count from the start of this month to the 15th, compared to the start of the previous month to the 15th. Is it possible to get both these values in a single search? Maybe using timewarp?

[BernardEAI]

I think I have found the solution:

index = index1 earliest=-1mon@mon latest=now()  
| timechart span=1d count as 1_Count
| eval Day=strftime(_time,"%d")
| where Day <= strftime(now(),"%d")
| timechart span=1mon sum(1_Count) as 2_count