I'm trying to create a timechart at intervals of one moth however the below code produces the sum of the entire month, I want the value on the 1st of each month,please let me know any solutions to get value as on
2022-10-01
2022-09-01
2022-08-01
source=all_month.csv place=*alaska* mag>=3.5 | timechart span=mon@mon1 count BY mag
The span=mon@mon1 option "rounds off" all event timestamps to the first day of their respective months. To count only the events that actually happened on the first day, discard those that did not.
source=all_month.csv place=*alaska* mag>=3.5
| where date_mday=1
| timechart span=mon@mon1 count BY mag
If your events don't have the date_mday field (it should be automatic) then you do the same thing by extracting the date from the timestamp.
source=all_month.csv place=*alaska* mag>=3.5
| eval date_mday = strftime(_time, "%d")
| where date_mday=1
| timechart span=mon@mon1 count BY mag
