Absolutely @mchoudhary So, what we are doing here is using a subsearch within the "table" command to generate the list of months you are interested in. Not many people realise but you can use a sub...
See more...
Absolutely @mchoudhary So, what we are doing here is using a subsearch within the "table" command to generate the list of months you are interested in. Not many people realise but you can use a subsearch in a lot more places than as part of an original search, e.g. to derive a variable for timechart span, or in our case to list some fields for your table command. Regarding the subsearch, this is what it is doing: 1. | makeresults count=7 Generates 7 dummy events (rows) to work with in the pipeline. (6 months ago + current month) 2. | streamstats count as month_offset For each of the 7 rows, assigns a sequential number in month_offset (from 1 to 7). This will be used to generate one value per month, going backwards in time. 3. | eval start_epoch=relative_time(now(),"-6mon@mon"), end_epoch=now() start_epoch calculates the epoch time at the start of the month, six months ago. -6mon@mon: Go back 6 months, then snap to the beginning of the month. end_epoch is the current epoch time. This sets the time range: from the start of 6 months ago until now. 4. | eval start_month=strftime(start_epoch, "%Y-%m-01") Formats start_epoch into a string representing the first day of the starting month (e.g., "2024-11-01"). 5. | eval month_epoch = relative_time(strptime(start_month, "%Y-%m-%d"), "+" . (month_offset-1) . "mon") For each row, this creates a timestamp for a month in the range. Increments from start_month by (month_offset - 1) months. month_offset runs 1 to 7. So, months generated will be: start_month + 0, +1, +2, ..., +6 months. This way, you get the start-of-month epoch for each month in the range. 6. | where month_epoch <= end_epoch Filters out any months whose starting epoch is greater than now (in case the 7 generated months go slightly into the future). 7. | eval month=strftime(month_epoch, "%b") Converts month_epoch into a "short month name" format (e.g., "Jan", "Feb", etc). 8. | stats list(month) as search Aggregates the results into a single row, with the months as a list, titled "search". This is then returned from the subsearch as a list which is consumed by the table command. If you ran the search by itself you would get: Please let me know if you have any further questions on this! I'm really pleased to have got to the bottom of it! Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing