I have this search:
index="tticket_contact_request"
|eval date=strftime(_time, "%Y-%m")
|stats count by des_service,des_problem,date
|eval service_problem= des_service.",".des_problem
|xyseries grouped=false service_problem,date,count
|sort service_problem
|rename service_problem as "des_service,des_problem"
|fillnull value=0
|addcoltotals label=Total
|fillnull value="total,total" "des_service,des_problem"
and I would like to add something like this:
| where _time >= relative_time(now(),"-1mon@mon") AND _time < relative_time(now(),"@mon")
to retrieve only data from last month. Any tips? I'll accept performance advice as well
Try this
index="tticket_contact_request" earliest=-1mon@mon latest=@mon
|eval date=strftime(_time, "%Y-%m")
|stats count by des_service,des_problem,date
|eval service_problem= des_service.",".des_problem
|xyseries grouped=false service_problem,date,count
|sort service_problem
|rename service_problem as "des_service,des_problem"
|fillnull value=0
|addcoltotals label=Total
|fillnull value="total,total" "des_service,des_problem"
Try this
index="tticket_contact_request" earliest=-1mon@mon latest=@mon
|eval date=strftime(_time, "%Y-%m")
|stats count by des_service,des_problem,date
|eval service_problem= des_service.",".des_problem
|xyseries grouped=false service_problem,date,count
|sort service_problem
|rename service_problem as "des_service,des_problem"
|fillnull value=0
|addcoltotals label=Total
|fillnull value="total,total" "des_service,des_problem"
thanks @somesoni2. I was overthinking a simple problem.
Give us some sample events.
an example:
des_service,des_problem|2017-04|2017-05
database,error|15|16
app,error|7|10
I'll like to show only the summarization from last month, in case '2017-05' to send in a csv report