How to add custom time range to my xyseries search?

[cvalenti]

I have this search:

 index="tticket_contact_request"
    |eval date=strftime(_time, "%Y-%m")
    |stats count by des_service,des_problem,date
    |eval service_problem= des_service.",".des_problem 
    |xyseries grouped=false service_problem,date,count
    |sort service_problem
    |rename service_problem as "des_service,des_problem"
    |fillnull value=0
    |addcoltotals label=Total
    |fillnull value="total,total" "des_service,des_problem"

and I would like to add something like this:

 | where _time >= relative_time(now(),"-1mon@mon") AND _time < relative_time(now(),"@mon")

to retrieve only data from last month. Any tips? I'll accept performance advice as well

[somesoni2 · Accepted solution]

Try this

index="tticket_contact_request" earliest=-1mon@mon latest=@mon
     |eval date=strftime(_time, "%Y-%m")
     |stats count by des_service,des_problem,date
     |eval service_problem= des_service.",".des_problem 
     |xyseries grouped=false service_problem,date,count
     |sort service_problem
     |rename service_problem as "des_service,des_problem"
     |fillnull value=0
     |addcoltotals label=Total
     |fillnull value="total,total" "des_service,des_problem"

[cvalenti]

thanks @somesoni2. I was overthinking a simple problem.

[woodcock]

Give us some sample events.

[cvalenti]

an example:

des_service,des_problem|2017-04|2017-05
database,error|15|16
app,error|7|10

I'll like to show only the summarization from last month, in case '2017-05' to send in a csv report