<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Comparing Multiple Years of Max Values in All Apps and Add-ons</title>
    <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/Comparing-Multiple-Years-of-Max-Values/m-p/123897#M9665</link>
    <description>&lt;P&gt;Hi &lt;/P&gt;

&lt;P&gt;I have a dataset with Time, by Day-Month-Year and a Integer value per day, something like this&lt;/P&gt;

&lt;P&gt;_time      mxo&lt;BR /&gt;
30-01-2010 6&lt;BR /&gt;
30-01-2011 8&lt;BR /&gt;
30-01-2012 3&lt;BR /&gt;
30-01-2013 5&lt;BR /&gt;
30-01-2014 9&lt;/P&gt;

&lt;P&gt;I want to make some timechart comparing by month over the years, like comparing 2 or more years of maximum number&lt;/P&gt;

&lt;P&gt;My first approach was using Timewrap with something like this&lt;/P&gt;

&lt;P&gt;host="smo*" earliest=-12m@y latest=-1m@m |timechart span=1Month max(mxo)  | timewrap y&lt;/P&gt;

&lt;P&gt;But seems out of range or something wrong&lt;BR /&gt;
External search command 'timewrap' returned error code 255. Script output = "ERROR "'timeunit' argument required, such as d, w, 2m, q, y" "&lt;/P&gt;

&lt;P&gt;Maybe someone have a better and working solution, &lt;/P&gt;</description>
    <pubDate>Sat, 28 Jun 2014 23:21:53 GMT</pubDate>
    <dc:creator>israelgutierrez</dc:creator>
    <dc:date>2014-06-28T23:21:53Z</dc:date>
    <item>
      <title>Comparing Multiple Years of Max Values</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/Comparing-Multiple-Years-of-Max-Values/m-p/123897#M9665</link>
      <description>&lt;P&gt;Hi &lt;/P&gt;

&lt;P&gt;I have a dataset with Time, by Day-Month-Year and a Integer value per day, something like this&lt;/P&gt;

&lt;P&gt;_time      mxo&lt;BR /&gt;
30-01-2010 6&lt;BR /&gt;
30-01-2011 8&lt;BR /&gt;
30-01-2012 3&lt;BR /&gt;
30-01-2013 5&lt;BR /&gt;
30-01-2014 9&lt;/P&gt;

&lt;P&gt;I want to make some timechart comparing by month over the years, like comparing 2 or more years of maximum number&lt;/P&gt;

&lt;P&gt;My first approach was using Timewrap with something like this&lt;/P&gt;

&lt;P&gt;host="smo*" earliest=-12m@y latest=-1m@m |timechart span=1Month max(mxo)  | timewrap y&lt;/P&gt;

&lt;P&gt;But seems out of range or something wrong&lt;BR /&gt;
External search command 'timewrap' returned error code 255. Script output = "ERROR "'timeunit' argument required, such as d, w, 2m, q, y" "&lt;/P&gt;

&lt;P&gt;Maybe someone have a better and working solution, &lt;/P&gt;</description>
      <pubDate>Sat, 28 Jun 2014 23:21:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/Comparing-Multiple-Years-of-Max-Values/m-p/123897#M9665</guid>
      <dc:creator>israelgutierrez</dc:creator>
      <dc:date>2014-06-28T23:21:53Z</dc:date>
    </item>
    <item>
      <title>Re: Comparing Multiple Years of Max Values</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/Comparing-Multiple-Years-of-Max-Values/m-p/123898#M9666</link>
      <description>&lt;P&gt;Note, &lt;CODE&gt;-12m&lt;/CODE&gt; moves you back twelve minutes, not twelve months... you're probably looking for &lt;CODE&gt;-12mon&lt;/CODE&gt;.&lt;/P&gt;</description>
      <pubDate>Sun, 29 Jun 2014 04:29:02 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/Comparing-Multiple-Years-of-Max-Values/m-p/123898#M9666</guid>
      <dc:creator>martin_mueller</dc:creator>
      <dc:date>2014-06-29T04:29:02Z</dc:date>
    </item>
    <item>
      <title>Re: Comparing Multiple Years of Max Values</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/Comparing-Multiple-Years-of-Max-Values/m-p/123899#M9667</link>
      <description>&lt;P&gt;I tried similar thing and the timewrap is somehow not accepting "y" as an option. Though "timewrap 12mon" works.  Try following&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;host="smo*" earliest=-3y@y latest=+y@y  |timechart span=1mon max(mxo) | timewrap 12month
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Tue, 01 Jul 2014 14:09:18 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/Comparing-Multiple-Years-of-Max-Values/m-p/123899#M9667</guid>
      <dc:creator>somesoni2</dc:creator>
      <dc:date>2014-07-01T14:09:18Z</dc:date>
    </item>
    <item>
      <title>Re: Comparing Multiple Years of Max Values</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/Comparing-Multiple-Years-of-Max-Values/m-p/123900#M9668</link>
      <description>&lt;P&gt;Thank you thats work&lt;/P&gt;</description>
      <pubDate>Tue, 01 Jul 2014 18:39:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/Comparing-Multiple-Years-of-Max-Values/m-p/123900#M9668</guid>
      <dc:creator>israelgutierrez</dc:creator>
      <dc:date>2014-07-01T18:39:32Z</dc:date>
    </item>
  </channel>
</rss>

