topic Re: multiple searches in one graph in Getting Data In

multiple searches in one graph

nirt — Thu, 12 Jul 2012 12:37:19 GMT

Hi,
I need to create a graph that contains 2 searches, to compare today's search and last week's search
I know there are lot of guides here that explain how to do it, however I'm quite a new splunk user and have tried for the past hours to try and get the graph to show properly however I was not able to product such working search
I was wondering if you guys could assist me in creating such search
My common search is as following:
host="stats" | xmlkv | timechart max(usersCount)

Thank you guys in advance

Re: multiple searches in one graph

sdaniels — Thu, 12 Jul 2012 13:30:28 GMT

Have you read through this? It gives a detailed walk through of one way to do it?

http://blogs.splunk.com/2012/02/19/compare-two-time-ranges-in-one-report/

Re: multiple searches in one graph

nirt — Mon, 28 Sep 2020 12:04:12 GMT

however, the graph does not look right - it shows all of today and then a small portiion of yesterday AFTER today instead in parallel

Re: multiple searches in one graph

nirt — Mon, 28 Sep 2020 12:05:23 GMT

In the tip you have posted it says there is an issue displaying all content of an append search for versions prior to 4.3.1, however I'm using 4.3.3 and still have that issue

Re: multiple searches in one graph

nirt — Mon, 28 Sep 2020 12:05:26 GMT

I'm having problems showing the graph properly when comparing last week's day to today
Each graph shows independatly instead of together
the following search is being used:

also tried eval new_time=_time+60*60*24*7

any ideas?

Re: multiple searches in one graph

carasso — Wed, 21 May 2014 19:01:47 GMT

Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way.

I wrote a convenient search command called "timewrap" that does it all, for arbitrary time periods.

... | timechart count span=1d | timewrap w

That's it!

http://apps.splunk.com/app/1645/