topic Re: How to plot data for two different time ranges in the same visualization? in Dashboards & Visualizations

How to plot data for two different time ranges in the same visualization?

mrncst — Tue, 24 Feb 2015 19:57:33 GMT

Hello, word!

I've started with Splunk a few days ago and still have a lot of questions.

I'd like to plot on the same graphic two different date ranges for the same metric (count by id). My aim is to compare two different scenarios around the same data (represented by an id), before and after a ux change in the website. Can you please help me?

Re: How to plot data for two different time ranges in the same visualization?

Raghav2384 — Tue, 24 Feb 2015 20:30:29 GMT

Hey There,

there are tons of posts on how to achieve this functionality.

http://blogs.splunk.com/2012/02/19/compare-two-time-ranges-in-one-report/ by Jon Webster

There is an app called Time Wrap in the splunk app base. Hope this will walk you in the right direction.

Thanks,
Raghav

Re: How to plot data for two different time ranges in the same visualization?

mrncst — Mon, 28 Sep 2020 19:02:50 GMT

Thank you for your time!

I'm following the post instructions and my search displays a visualization but the lines aren't superimposed:

My search query:

index=ux app=* country=BRA type=UIInputError id=client-first-name earliest=-2d@d latest=-1d@d | eval ReportKey="today" | append [search index=ux app=* country=BRA type=UIInputError id=client-first-name earliest=-4d@d latest=-3d@d | eval ReportKey="yesterday"| eval _time=_time+60*60*24] | timechart span=10m count(id) by ReportKey

Re: How to plot data for two different time ranges in the same visualization?

somesoni2 — Tue, 24 Feb 2015 22:17:05 GMT

The time difference between two searches is 2 days. Update your time adjustment to 2 days

| eval _time =  _time + 2*86400

Re: How to plot data for two different time ranges in the same visualization?

Raghav2384 — Tue, 03 Mar 2015 20:51:38 GMT

Please accept as answer / leave comments so that it would be easier for others to see the post.

Thanks,
Raghav

Re: How to plot data for two different time ranges in the same visualization?

landen99 — Mon, 07 Aug 2017 18:25:28 GMT

Here is a much more elegant solution which can plot all days on the same day in timechart:

| eval series=strftime(_time, "%m-%d") | eval time_delta=(now-_time)/86400,time_day=ceiling(time_delta),_time=_time+time_day*86400 | eval day=case(time_day=0,"Today",time_day=1,"Yesterday",time_day=8,"SD last week") | timechart fixedrange=false sum(count) by day

This allows you to plot any time range by series or to assign nice names in the case statement to each day based on its relation to the current time/day. 86400 is the number of seconds in a day.