Thanks. I did make changes and worked for me.
I have data of index="ansible_tower" of last two months, in terms of extracting those all data with timechart as mentioned in your search query, how do I change the span for this for two months? I believe with span=1d only collects data of a week per the result i am seeing of below query.
index="ansible_tower" | table created job failed | sort created + desc | dedup job | eval _time=strptime(created,"%Y-%m-%dT%H:%M:%S.%3N%Z") | timechart span=1d count by failed | rename False as Succeed True as Failed
... View more