https://community.splunk.com/t5/Dashboards-Visualizations/Help-with-Dashboard-Form-Chart-Overlay-based-on-Time-Range/m-p/184963#M11421 <P>I would like to build a chart to compare errors from a specific time range to another. In this example a baseline day from the past and a day there was an event. The user can choose two time ranges and I want to show them a comparison as an overlay. I'm struggling with how to set the time modifier variable. I saw that you can do something like this - <CODE>|eval basetime=8 |eval evtime=1 | eval diff=basetime-evtime</CODE> to get a difference, but I am not sure how to get the values to do the diff on. I believe I need to get the number of days difference between the earliest of the baseline timerange (assuming it is in the past) and the earliest of the 'Event' time range. Then I would plug this value in the formula for the time modification (creates the overlay)<CODE>|eval _time=_time+60*60*24*diff</CODE> </P> <P><CODE><BR /> index=myindex earliest=$time2.earliest$ latest=$time2.latest$ sourcetype=mysourcetype | bucket _time span=1hr | stats count by _time | eval ReportKey="Event" <BR /> |append [search index=myindex earliest=$time1.earliest$ latest=$time1.latest$ sourcetype=mysourcetype | bucket _time span=1hr | stats count by _time |eval ReportKey="Baseline"<BR /> |eval _time=_time+60*60*24*diff] | timechart values(count) by ReportKey<BR /> </CODE></P> <P>Does anyone have any idea how this could be done?</P> <P>Thanks!</P> Mon, 28 Sep 2020 19:13:13 GMT jgbricker 2020-09-28T19:13:13Z https://community.splunk.com/t5/Dashboards-Visualizations/Help-with-Dashboard-Form-Chart-Overlay-based-on-Time-Range/m-p/184963#M11421 <P>I would like to build a chart to compare errors from a specific time range to another. In this example a baseline day from the past and a day there was an event. The user can choose two time ranges and I want to show them a comparison as an overlay. I'm struggling with how to set the time modifier variable. I saw that you can do something like this - <CODE>|eval basetime=8 |eval evtime=1 | eval diff=basetime-evtime</CODE> to get a difference, but I am not sure how to get the values to do the diff on. I believe I need to get the number of days difference between the earliest of the baseline timerange (assuming it is in the past) and the earliest of the 'Event' time range. Then I would plug this value in the formula for the time modification (creates the overlay)<CODE>|eval _time=_time+60*60*24*diff</CODE> </P> <P><CODE><BR /> index=myindex earliest=$time2.earliest$ latest=$time2.latest$ sourcetype=mysourcetype | bucket _time span=1hr | stats count by _time | eval ReportKey="Event" <BR /> |append [search index=myindex earliest=$time1.earliest$ latest=$time1.latest$ sourcetype=mysourcetype | bucket _time span=1hr | stats count by _time |eval ReportKey="Baseline"<BR /> |eval _time=_time+60*60*24*diff] | timechart values(count) by ReportKey<BR /> </CODE></P> <P>Does anyone have any idea how this could be done?</P> <P>Thanks!</P> Mon, 28 Sep 2020 19:13:13 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Help-with-Dashboard-Form-Chart-Overlay-based-on-Time-Range/m-p/184963#M11421 jgbricker 2020-09-28T19:13:13Z https://community.splunk.com/t5/Dashboards-Visualizations/Help-with-Dashboard-Form-Chart-Overlay-based-on-Time-Range/m-p/184964#M11422 <P>The timewrap app works nicely <A href="https://splunkbase.splunk.com/app/1645/">https://splunkbase.splunk.com/app/1645/</A></P> Fri, 22 Jan 2016 12:40:54 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Help-with-Dashboard-Form-Chart-Overlay-based-on-Time-Range/m-p/184964#M11422 jgbricker 2016-01-22T12:40:54Z