https://community.splunk.com/t5/Splunk-Search/Compare-total-by-today-with-yesterday-and-against-the-7dayavg/m-p/343496#M101749 <P>It's giving you that because you have fed it data at the hourly basis, so it is assuming you care about hours. If you are trying to calculate on a daily basis, rather than hourly, change this line - </P> <PRE><CODE> | timechart count span=1h </CODE></PRE> <P>to</P> <PRE><CODE> | timechart count span=1d </CODE></PRE> Thu, 09 Mar 2017 15:59:18 GMT DalJeanis 2017-03-09T15:59:18Z https://community.splunk.com/t5/Splunk-Search/Compare-total-by-today-with-yesterday-and-against-the-7dayavg/m-p/343495#M101748 <P>I have the following query where I am trying to utilize timewrap to display the total number of credit cards used as a payment method today, yesterday, and compare it to the 7 day average. </P> <PRE><CODE>base search... | payment_method=credit_card | timechart count span=1h | timewrap d series=short | addtotals s* | eval 7dayavg=Total/7.0 | table _time, _span, s0, s1, 7dayavg | rename s0 as now, s1 as yesterday </CODE></PRE> <P>The problem is currently that the legend shows 4 data series labeled 6:00 PM - 12:00 AM, 12:00 AM - 6:00 AM, 6:00 AM - 12:00 PM, 12:00 PM - 6:00 PM when I would like for it to be today, yesterday, and 7dayavg. The x-axis barely starts from 6:00 pm however I would like it to start from the beginning of the day today (midnight) compared to the beginning of the day yesterday (midnight), with the 7 day average at midnight. </P> <P>Thank you</P> Thu, 09 Mar 2017 01:48:56 GMT https://community.splunk.com/t5/Splunk-Search/Compare-total-by-today-with-yesterday-and-against-the-7dayavg/m-p/343495#M101748 demkic 2017-03-09T01:48:56Z https://community.splunk.com/t5/Splunk-Search/Compare-total-by-today-with-yesterday-and-against-the-7dayavg/m-p/343496#M101749 <P>It's giving you that because you have fed it data at the hourly basis, so it is assuming you care about hours. If you are trying to calculate on a daily basis, rather than hourly, change this line - </P> <PRE><CODE> | timechart count span=1h </CODE></PRE> <P>to</P> <PRE><CODE> | timechart count span=1d </CODE></PRE> Thu, 09 Mar 2017 15:59:18 GMT https://community.splunk.com/t5/Splunk-Search/Compare-total-by-today-with-yesterday-and-against-the-7dayavg/m-p/343496#M101749 DalJeanis 2017-03-09T15:59:18Z https://community.splunk.com/t5/Splunk-Search/Compare-total-by-today-with-yesterday-and-against-the-7dayavg/m-p/343497#M101750 <P>Thank you for your response. I realize I wasn't very clear in my question. To clarify, I am using the custom timewrap extension and would like a graph to display on the x-axis the <STRONG>hours</STRONG> against today, yesterday, and the 7-day average. </P> <P>Essentially, I would see three lines going across with a data point at each hour (01, 02, 03, 04...- .. 22, 23). </P> Thu, 09 Mar 2017 21:47:30 GMT https://community.splunk.com/t5/Splunk-Search/Compare-total-by-today-with-yesterday-and-against-the-7dayavg/m-p/343497#M101750 demkic 2017-03-09T21:47:30Z https://community.splunk.com/t5/Splunk-Search/Compare-total-by-today-with-yesterday-and-against-the-7dayavg/m-p/343498#M101751 <P>In this above query i want to include prior week like last 14 days and instead of 7dayavg i want eventcount </P> Thu, 16 Aug 2018 08:19:55 GMT https://community.splunk.com/t5/Splunk-Search/Compare-total-by-today-with-yesterday-and-against-the-7dayavg/m-p/343498#M101751 john_q 2018-08-16T08:19:55Z