How to get stats by month?

[SS1]

Hi,

I have my current search giving below output, I want to have stats listed by Month. Can someone help on this one

Current Search:  my search |  eval True=(total1-total2) | eval False=round(False/(True+False)*100,2) | table False

Output:        False

                        42.12

Desired Output: 

Month      False

August    42.12

July           xx.xx

june           xx.xx

.

.

.

[ITWhisperer]

| bin _time span=1mon

[SS1]

It still doesn't give monthly stats, still shows just the value

[bowesmana]

with bin command, you would normally then use "stats xxxx by _time" to then group values according to the month and then you do your true/false calculations on that.

What is in 'my search' part of your search?

[SS1]

My search

index=action AND "True" | dedup _time| stats count as total1| appendcols [search index=action AND "[Home]" | dedup _time| stats count as total2] | appendcols [search index=action AND "False" | dedup _time| stats count as False]| eval True=(total1-total2)|eval False=round(False/(False+True)*100,2)| table False

[bowesmana]

OK, without knowing your data, I would suggest that using appendcols is not the best way to approach the problem.  I am not sure why you are deduping _time. 

You have events in index=action that can have

a) any ONE of the 3 possible (True, [Home], False)
b) one or more of (True, [Home], False)

and as you are deduping _time, it may be that you have more than one with the identical _time value

Depending on the answers to the above, this may be an option

index=action AND ("True" OR "[Home]" OR  "False")
| eval T=if(match(_raw, "(?i)True"), 1, 0)
| eval H=if(match(_raw, "(?i)\[Home\]"), 1, 0)
| eval F=if(match(_raw, "(?i)False"), 1, 0)
| bin _time span=1mon
| stats sum(T) as T sum(H) as H sum(F) as F count by _time
| eval True=(T-H) 
| eval False=round(F/(F+True)*100,2) 
| table False

A single search to collect all data. Some eval statements to determine the type of data you are looking at and then the bin of time for 1 month the stats by _time (i.e. 1 month)

Then the calculates for the True/Home/False values.

However, your reason for deduping _time is significant. If there is more than one T, H or F at _time and you want to disregard those, this is not right as it will count those twice.

You could add a 

| stats max(T) as T max(H) as H max(F) as F by _time

before the | bin command to get either a 1 or 0 for time for each value of _time before you aggregate to 1 month.