Can you please try this?
| bin _time span=1d
| stats count by _time
| eval time_chunk = case(
_time > relative_time(now(), "-45d") AND _time < relative_time(now(), "-30d"), "Applications sits in New Applications Status > 30 days",
_time > relative_time(now(), "-60d") AND _time < relative_time(now(), "-45d"), "Applications sits in New Applications Status > 45 days",
_time > relative_time(now(), "-90d") AND _time < relative_time(now(), "-60d"), "Applications sits in New Applications Status > 60 days",
_time > relative_time(now(), "-90d") ,"Applications sits in New Applications Status > 90 days")
| stats count by time_chunk
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
Hey Hi!
I am getting result for 45 days, 60 days, but not for 90+days.
The data has only 16 events. it is not pulling that data.
Hi @haripotu,
what's the retention of the index that you're using in your search?
probably it has a retention of 90 days.
If you want to have older information, you have to enlarge the retention of that index, but, as you know, it has also a larger storage consuption (not license).
Ciao.
Giuseppe