Hi Sundareshr
I am using this logic currently but when we check for total active entities and compare with this query there is a difference of two or three entites.
eval Date = strftime ("_time","%Y/%m")| stats last (_time) as _time last (status) as status by entityId l, Date|eventstats first (Date) as Date1by entityId|streamstats first (status) as statusnew by entityId window=2 | eval status1 = case ( (Date1=Date AND status=A),1,(Date1!=Date AND status1!=statusnew AND status=A),1,(Date!=Date AND status1!=statusnew),-1,(Date1!=Date AND status=statusnew),0,(Date1=Date AND status=I) OR (Date1=Date AND status=P) ,0, (Date1!=Date AND status=P) OR ( Date1!=Date AND status=I) ,0))|timechart span=mon sum(status1) as Active|accum Active
... View more