Using dedup in multi-month query

[wu_weidong]

I'm trying to create a timechart showing the count of events over 6 months. The query is

index=itemdb `macrotest` (name != "*itemA" AND name != "*itemB") | eval category = case(...) | eval fields = split(name,"_") | eval mname = mvindex(fields,1) | search category = "promo" | dedup f_1 f_2 | timechart count by id span=1mon

The goal is to dedup within that month only, not across all 6 months. For example, if the same values of f_1,f_2 appear in all 6 months, I should get 1 count of f_1,f_2 in each of the 6 months, not only in the last month. However, it seems like the f_1,f_2 values will be dedup across all 6 months, and appear only in the last month.

Can I bin events by the months they appear in, then dedup within that month only to achieve this? Or is there another way?

[to4kawa]

index=itemdb `macrotest` (name != "*itemA" AND name != "*itemB") 
| eval category = case(...) 
| eval fields = split(name,"_") 
| eval mname = mvindex(fields,1) 
| search category = "promo" 
| eval f_1_tmp=f_1.":".strftime(_time,"%Y%m"),f_2_tmp=f_2.":".strftime(_time,"%Y%m")
| dedup f_1_tmp f_2_tmp 
| timechart count by id span=1mon