What about this approach?
searchstring earliest=-12month@month latest=-1month@month
| bucket _time span=1mon
| stats sum(users) as users by _time
| eval Month = strftime(_time, "%b %Y") | addinfo
| appendcols [ search searchstring
| eval earliest_time=relative_time(info_min_time,"-2m")
| eval latest_time=relative_time(info_max_time,"-1m")| where _time>earliest_time and _time<=latest_time| eval ReportKey="previousmonth"| timechart span=1mon sum(users) as prev_month_users by previousmonth]
I think is the way to get previous month value for every month but relative_time functions or addinfo seems not to be working ...
Thank you again for your help.
... View more