Here is my search: ...
earliest="4/1/2024:00:00:00" latest="8/1/2024:00:00:00"
| bin span=1h _time
| addinfo
| eval marker = if(_time < (relative_time(info_min_time,"+1mon@mon@w")), "April","Jul...
See more...
Here is my search: ...
earliest="4/1/2024:00:00:00" latest="8/1/2024:00:00:00"
| bin span=1h _time
| addinfo
| eval marker = if(_time < (relative_time(info_min_time,"+1mon@mon@w")), "April","July")
| eval _time = if(_time < (relative_time(info_min_time,"+1mon@mon@w")),_time + 90*24*3600, _time)
| chart count max(data) by _time marker
| where _time>=relative_time(now(), "-1mon@mon@w") with the above my April chart is shifted over July but it does not starts from the first day of the month but last June. in my eval _time shift: 3rd line from the bottom I would like to know how can I reflect exact month days instead doing "+90*23*3600", ( April,July = 31days, where June is 30), thanks