Dynamic/multiple earliest and latest in month over month stats/reports in the same search

[dearimranz]

I have a following search.

......| dedup field1 | timechart count by date_month limit=10

This gives me monthly counts and I choose earliest and latest from the time picker.

Is it possible to have earliest and latest for each month? For example when I make a monthly stats/count for 2013, is it possible to have the earliest and latest in the following way in the one search?

For January 2013 - earliest=01-01-2013 latest=31-01-2013
For February 2013 - earliest=01-02-2013 latest=31-02-2013
For March 2013 - earliest=01-03-2013 latest=31-03-2013
and so on...

I have also tried

....| dedup field1 | timechart span=mon count(field1)

But it does not give the correct count since dedup command chooses distinct events and ignore some events when time span is "All time" or more than a month.

[martin_mueller · Accepted solution]

So... you're trying to dedup within each month only? Try this:

... | dedup field1 date_year date_month | timechart span=1mon count

[dearimranz]

hmmmm, worked perfectly fine. Thanks a lot.

[dearimranz]

I changed the question to make it more understandable, can you please check now. I tried timechart span=1mon but it does not give me correct count because dedup command chooses the distinct events and ignore the latest events in some months when search runs for "All time" or more than one month.

[martin_mueller]

Are you possibly looking for timechart span=mon?

[Ayn]

Not sure I understand the question, but would this accomplish what you're after?

earliest=-mon@mon latest=@mon

This would grab everything from 00:00 on the 1st of last month until 00:00 on the 1st of this month.

[dearimranz]

I changed the question to make it more understandable, can you please check now. I tried timechart span=1mon but it does not give me correct count because dedup command chooses the distinct events and ignore the latest events in some months when search runs for "All time" or more than one month.

[Ayn]

Well still not sure I understand your requirements correctly, but timechart?

... | timechart span=1mon...