Compare previous month total at the same day as current day



I would like to generate a count for the current month to date (today), and compare this with the count of the previous month, to the same day. So for instance, the count from the start of this month to the 15th, compared to the start of the previous month to the 15th. Is it possible to get both these values in a single search? Maybe using timewarp?

Labels (1)
0 Karma


I think I have found the solution:

index = index1 earliest=-1mon@mon latest=now()  
| timechart span=1d count as 1_Count
| eval Day=strftime(_time,"%d")
| where Day <= strftime(now(),"%d")
| timechart span=1mon sum(1_Count) as 2_count


Tags (1)
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.