search query for line graph

[elaine0102]

earliest=-30d@d-1h latest=-1d@d+11h

| bucket _time span=24h

| stats sum(eval(if((date_hour>=23) OR (date_hour<11),1,0))) as TimeWindowCount by _time

| rename TimeWindowCount as "events"

Hi, above is my search for line graph to display my past 30 days events. However, the above only return me about 15 days.

Any one knows whats wrong? Or even better if I can search for the whole month of the previous month (meaning now is November, my line graph would display the whole of October events)

[kristian_kolb · Accepted solution]

Would that do?

earliest=-1mon@mon latest=@mon

Hope this helps,

Kristian