Using the filter on the visualization page


(R Heng) #1

I'm trying to break down information by months. I'd like to group things that occurred between 1 month and now, 3months to 1 month, etc.

I could use the Date Range, but i'd like to use the filter since i could customize the label on my visualization.
The problem is, i can't seem to find the correct syntax to do this:

date: [ now-1M/M TO now]
date: [now-3M/M TO now-1M/M]


(R Heng) #2

I figured it out.


(Tanya Bragin) #3

What was the solution?


(R Heng) #4

The syntax I had was correct. I was working on a different index that didn't have that field name. So it was my mistake.

For filters:

date:[now-1M/M TO now] is the correct syntax to display events 1 month ago.


(system) #5