| makeresults
| eval _raw="Date,ID,Type,Duration
2019-11-22,ABC,XYZ,4
2019-11-26,BCD,YZX,2"
| multikv
| table Date,ID,Type,Duration
| rename COMMENT as "this is the sample you provide"
| rename COMMENT as "From here, the logic"
| eval Date=strptime(Date,"%F")
| eval Date_after = relative_time(Date,"+".(Duration - 1)."d")
| eval Date=mvappend(Date,Date_after)
| mvexpand Date
| rename Date as _time
| timechart span=1d values(*) as *
| rename _time as Date
| table Date,ID,Type,Duration
| filldown ID, Type
| reverse
| streamstats count as Duration by ID
| reverse
| fieldformat Date=strftime(Date,"%F")
Hi, @komalg
How about this?
... View more