How to restrict particular month data?

[Keerthi]

hi, have a qn  in the below query

| makeresults count=730
| streamstats count
| eval _time=_time-(count*86400)
| timechart Count as Timestamp span=1mon
| join type=left _time [| savedsearch XYZ
| eval today = strftime(relative_time(now(), "@d"), "%Y-%m-%d %H:%M:%S.%N")
| where like (APP_NAME ,"Managed iMAP Application") and like (BS_ID,"%") and like (Function,"%") and like (DEPARTMENT_LONG_NAME,"%") and like (COUNTRY,"%") and like(EMPLOYEE_TYPE,"%") and STATUS="active"
| eval _time = strptime(FROM_DATE, "%Y-%m-%d %H:%M:%S.%N")
| eval _time!= "2023-07"
| timechart Count as Created span=1mon
| streamstats sum(Created) as Createdcumulative]
| join type=left _time
[| savedsearch XYZ
| where like (APP_NAME ,"Managed iMAP Application") and like (BS_ID,"%") and like (Function,"%") and like (DEPARTMENT_LONG_NAME,"%") and like (COUNTRY,"%") and like(EMPLOYEE_TYPE,"%") and STATUS="inactive"
| eval _time = strptime(TO_DATE, "%Y-%m-%d %H:%M:%S.%N")
| timechart Count as Deactivated span=1mon
| streamstats sum(Deactivated) as Deactivatedcumulative]
| eval Active = Createdcumulative
| eval Deactivated = Deactivatedcumulative
| where _time>=relative_time(now(),"-1y@d")

| fields - Createdcumulative, Deactivatedcumulative, Timestamp

the below query fetches me the results below:

 i need to restrict the data till the previous month and not show current month. can anyone help me with modifying the query pls

[cklunck]

What if you change line 4 to:

| timechart Count as Timestamp span=1mon partial=f

This will drop the data from the "partial" data set for the current month, and will only display months that have a complete set of data.

Note that this will also remove a "partial" month at the beginning of the dataset, if one exists. You might need to extend your time range back a bit farther to account for that.