How to get the count of the last 30 days, for a 15 min period for each day- without using dc

[dwibedi03]

My index is getting refreshed every 15 mins and new data gets populated every 15 mins.
I need to count the events for the last 15 mins for each day in a period of 30 days.

Currently, I am doing dc(field) for each day but it removes all the duplicates events and my count is not what I want.

I want to get the count of the last 30 days for a 15 mins period for each day without using dc.

[woodcock · Accepted solution]

Like this (run for Last 30 days)?

... | timechart span=15m count BY source and maybe other fields here
| eval day = strftime(_time, "%Y%m%d")
| reverse
| dedup day

[richgalloway]

dc is short for distinct_count, which counts the number of unique values, hence duplicates are not counted.
Consider using c or count, instead.

[dwibedi03]

I was doing count and it was giving a sum of whole day