Hi,
I have given a query to return me a list of details as below , however the results for all of 30 days are not populating . Instead its giving only the results for last 3 days..
"http://pinky/createcustomer" NOT "http:/pinky/confirmcustomer" | join type=left vsid [ search "http:/pinky/searchcustomer" ] | eval time=strftime(_time,"%a %B %d %Y %H:%M:%S.%N")| stats count(vsid) as TempcustomerCount list(email) as Email list(firstname) as FirstName list(lastname) as LastName list(JSESSIONID) as JSessionID list(time) as Time by customerCode,previewCode,vsid | where TempcustomerCount>=5