why it is not giving the results of all commands but on the 90 days command

[haripotu]

bin _time span=1d |stats count by _time

| eval time_chunk = case(
_time > relative_time(now(), "-30d") AND _time < relative_time(now(), "-45d"), "Applications sits in New Applications Status > 30 days",
_time > relative_time(now(), "-45d") AND _time < relative_time(now(), "-60d"), "Applications sits in New Applications Status > 45 days",
_time > relative_time(now(), "-60d") AND _time < relative_time(now(), "-90d"), "Applications sits in New Applications Status > 60 days",
_time > relative_time(now(), "-90d") ,"Applications sits in New Applications Status > 90 days")
| stats count by time_chunk

[kamlesh_vaghela]

@haripotu 

Can you please try this?

 
| bin _time span=1d 
| stats count by _time 
| eval time_chunk = case(
    _time > relative_time(now(), "-45d") AND _time < relative_time(now(), "-30d"), "Applications sits in New Applications Status > 30 days",
    _time > relative_time(now(), "-60d") AND _time < relative_time(now(), "-45d"), "Applications sits in New Applications Status > 45 days",
    _time > relative_time(now(), "-90d") AND _time < relative_time(now(), "-60d"), "Applications sits in New Applications Status > 60 days",
    _time > relative_time(now(), "-90d") ,"Applications sits in New Applications Status > 90 days") 
| stats count by time_chunk

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[haripotu]

Hey Hi! 

I am getting result for 45 days, 60 days, but not for 90+days.

[haripotu]

The data has only 16 events. it is not pulling that data. 

[gcusello]

Hi @haripotu,

what's the retention of the index that you're using in your search?

probably it has a retention of 90 days.

If you want to have older information, you have to enlarge the retention of that index, but, as you know, it has also a larger storage consuption (not license).

Ciao.

Giuseppe