I have a query that finds what I need for the current time and saved it as a scheduled report. However, I also need the same statistics from my historical data but I can't seem to figure out a good way to execute it.  The query: index=red_cont | dedup id sortby - _time | where status=="blue" | stats count by level The query is run at the beginning of every hour which is great for current and future but how would I go about getting a snapshot count of every hour from a certain date such as "1/1/21" - till now.  I understand I can do this manually one hour at a time using the time picker and changing the latest hour but that would take a really long time. Thanks  ... View more

Hello all, I'm having trouble getting the correct difference in time when subtracting from the "now() " functions. Any help would be appreciated. Here is my sample query :   Where my start time stamp looks like: 2005-07-05T04:28:34.453494Z     index=main | where status_1="open" | eval start=strptime(create_time, "%Y-%m-%dT%H:%M:%S.%6QZ" | eval current_time=now() | eval diff=current_time-start | fieldformat diff=tostring(diff, "duration") | table _time, id_box, diff, start, end  ... View more