This is awesome and I used it and modified it for my own purposes (counting business days in a month). But users might want to know that the mvrange function will stop before it reaches the value in the second argument if it is an exact multiple of the third argument (see | makeresults| eval foo=mvrange(0, 10, 2) ).
This is significant only if you want to make sure that the last value is counted -- in this example, the minute that occurs at the close_time. This search will count up to and including 19:59, which is probably the intent of the search. But if you are counting business days in a month, and the last day of the month is a business day, you'll want to add +1 to the mvrange to force the mv field to include the last in . See | makeresults| eval foo=mvrange(0, 11, 2) for counting to 10 by increments of 2.
Oops, and noticed a typo in line 10 -- do you mean that to be %M for minutes?
Great example, and thanks much!
... View more