Could someone help me understand this search?

[Keerthi]

| makeresults count=730
| streamstats count
| eval _time=_time-(count*86400)
| timechart Count as Timestamp span=1mon
| join type=left _time [| savedsearch XYZ
| eval today = strftime(relative_time(now(), "@d"), "%Y-%m-%d %H:%M:%S.%N")
| where like (APP_NAME ,"%") and like (BS_ID,"%") and like (Function,"%") and like (DEPARTMENT_LONG_NAME,"%") and like (COUNTRY,"%") and like(EMPLOYEE_TYPE,"%")
| eval _time = strptime(FROM_DATE, "%Y-%m-%d %H:%M:%S.%N")
| timechart Count as Created span=1mon
| streamstats sum(Created) as Createdcumulative]
| join type=left _time
[| savedsearch XYZ
| where like (APP_NAME ,"%") and like (BS_ID,"%") and like (Function,"%") and like (DEPARTMENT_LONG_NAME,"%") and like (COUNTRY,"%") and like(EMPLOYEE_TYPE,"%")
| eval _time = strptime(TO_DATE, "%Y-%m-%d %H:%M:%S.%N")
| timechart Count as Deactivated span=1mon
| streamstats sum(Deactivated) as Deactivatedcumulative]

can anyone explain me the code please. am new and need this brief please.

[ITWhisperer]

| makeresults count=730
| streamstats count
| eval _time=_time-(count*86400)
| timechart Count as Timestamp span=1mon

This generates a set of values for _time which represent the beginning of the month for the past 2 years

| join type=left _time [| savedsearch XYZ
| eval today = strftime(relative_time(now(), "@d"), "%Y-%m-%d %H:%M:%S.%N")
| where like (APP_NAME ,"%") and like (BS_ID,"%") and like (Function,"%") and like (DEPARTMENT_LONG_NAME,"%") and like (COUNTRY,"%") and like(EMPLOYEE_TYPE,"%")
| eval _time = strptime(FROM_DATE, "%Y-%m-%d %H:%M:%S.%N")
| timechart Count as Created span=1mon
| streamstats sum(Created) as Createdcumulative]

This joins the Created counts for each month

| join type=left _time
[| savedsearch XYZ
| where like (APP_NAME ,"%") and like (BS_ID,"%") and like (Function,"%") and like (DEPARTMENT_LONG_NAME,"%") and like (COUNTRY,"%") and like(EMPLOYEE_TYPE,"%")
| eval _time = strptime(TO_DATE, "%Y-%m-%d %H:%M:%S.%N")
| timechart Count as Deactivated span=1mon
| streamstats sum(Deactivated) as Deactivatedcumulative]

This joins the Deactivate counts for each month

[Keerthi]

Does the created and deactivated count is based on FROM_DATE and TO_DATE?

[ITWhisperer]

It looks like it since you have reset _time based the parsing of the two fields.