Hi @vvemula Based on your use case the following should do what you want ... index=_internal sourcetype=servers_list earliest=-90d@d
| stats
count(eval(if(_time <= relative_time(now(), "-30d@d"), Parameter, null() ) )) as "30 Days"
count(eval(if(_time <= relative_time(now(), "-60d@d"), Parameter, null() ) )) as "60 Days"
count(eval(if(_time <= relative_time(now(), "-90d@d"), Parameter, null() ) )) as "90 Days"
BY Value If you want distinct 30 days period counts then adjust the eval statement, e.g. stats ...
count(eval(if(_time > relative_time(now(), "-30d@d") AND _time <= relative_time(now(), "-60d@d"), Parameter, null() ) )) AS "30-60 Days"
... Hope this helps. If it does then please mark post as solved.
... View more