https://community.splunk.com/t5/Splunk-Search/Day-to-day-comparison-Using-stats-and-timechart/m-p/420460#M170751 <P>No, this is what I am looking for.</P> <P>Hours AverageCount TodaysCount<BR /> 00 4 0<BR /> 01 0 3<BR /> 02 5 2<BR /> .<BR /> .<BR /> .<BR /> .<BR /> .<BR /> .<BR /> 24 0 0</P> Wed, 12 Jun 2019 17:27:04 GMT sandeepmakkena 2019-06-12T17:27:04Z https://community.splunk.com/t5/Splunk-Search/Day-to-day-comparison-Using-stats-and-timechart/m-p/420458#M170749 <P>sourcetype="SysEvents" OR sourcetype="Sysout" TransactionId=TI* AND TransactionId!=TI earliest=-d@d latest=@d<BR /> | timechart span=1h count<BR /> | eval Hour = strftime(_time, "%H")<BR /> | stats avg(count) as AverageCount by Hour<BR /> | join Hour<BR /> [sourcetype="SysEvents" OR sourcetype="Sysout" TransactionId=TI* AND TransactionId!=TI AND TransactionId!=OPF earliest=@d latest=@h<BR /> | timechart span=1h count<BR /> | eval Hour = strftime(_time, "%H")<BR /> | stats count as TodaysCount by Hour]</P> <P>It seems to be working fine, but it doesn't show any results if one of the search period doesn't have any results.</P> <P>No, this is what I am looking something like this and display this stats on time chart.</P> <P>Hours AverageCount TodaysCount<BR /> 00 4 0<BR /> 01 0 3<BR /> 02 5 2<BR /> .<BR /> .<BR /> .<BR /> .<BR /> .<BR /> .<BR /> 24 0 0</P> <P>Thanks.</P> Wed, 30 Sep 2020 00:53:58 GMT https://community.splunk.com/t5/Splunk-Search/Day-to-day-comparison-Using-stats-and-timechart/m-p/420458#M170749 sandeepmakkena 2020-09-30T00:53:58Z https://community.splunk.com/t5/Splunk-Search/Day-to-day-comparison-Using-stats-and-timechart/m-p/420459#M170750 <P>Try <CODE>append</CODE> with <CODE>stats</CODE>. Also, I'm not sure how this is running without a <CODE>search</CODE> command inside the subsearch.</P> <PRE><CODE>sourcetype="SysEvents" OR sourcetype="Sysout" TransactionId=TI* AND TransactionId!=TI earliest=-d@d latest=@d | timechart span=1h count | eval Hour = strftime(_time, "%H") | stats avg(count) as AverageCount by Hour | append [search sourcetype="SysEvents" OR sourcetype="Sysout" TransactionId=TI* AND TransactionId!=TI AND TransactionId!=OPF earliest=@d latest=@h | timechart span=1h count | eval Hour = strftime(_time, "%H") | stats count as TodaysCount by Hour] | stats min(AverageCount) as AverageCount, min(TodaysCount) as TodaysCount by Hour | fillnull value=0 AverageCount TodaysCount </CODE></PRE> Wed, 12 Jun 2019 15:39:10 GMT https://community.splunk.com/t5/Splunk-Search/Day-to-day-comparison-Using-stats-and-timechart/m-p/420459#M170750 grittonc 2019-06-12T15:39:10Z https://community.splunk.com/t5/Splunk-Search/Day-to-day-comparison-Using-stats-and-timechart/m-p/420460#M170751 <P>No, this is what I am looking for.</P> <P>Hours AverageCount TodaysCount<BR /> 00 4 0<BR /> 01 0 3<BR /> 02 5 2<BR /> .<BR /> .<BR /> .<BR /> .<BR /> .<BR /> .<BR /> 24 0 0</P> Wed, 12 Jun 2019 17:27:04 GMT https://community.splunk.com/t5/Splunk-Search/Day-to-day-comparison-Using-stats-and-timechart/m-p/420460#M170751 sandeepmakkena 2019-06-12T17:27:04Z https://community.splunk.com/t5/Splunk-Search/Day-to-day-comparison-Using-stats-and-timechart/m-p/420461#M170752 <P>You should checkout <CODE>timewrap</CODE>. This will do exactly what you need. It should always be passed after <CODE>timechart</CODE> command like this.. Make sure to set your timerange to something like the last 7 days so you can get 7 lines showing day over day</P> <PRE><CODE>sourcetype="SysEvents" OR sourcetype="Sysout" TransactionId=TI* AND TransactionId!=TI earliest=-7d@d latest=@d | timechart span=1h count | timewrap 1d </CODE></PRE> Wed, 12 Jun 2019 18:03:47 GMT https://community.splunk.com/t5/Splunk-Search/Day-to-day-comparison-Using-stats-and-timechart/m-p/420461#M170752 skoelpin 2019-06-12T18:03:47Z https://community.splunk.com/t5/Splunk-Search/Day-to-day-comparison-Using-stats-and-timechart/m-p/420462#M170753 <P>I am sorry it did work, but it doesn't display anything if both the time ranges don't have any transactions. </P> Thu, 13 Jun 2019 14:42:55 GMT https://community.splunk.com/t5/Splunk-Search/Day-to-day-comparison-Using-stats-and-timechart/m-p/420462#M170753 sandeepmakkena 2019-06-13T14:42:55Z https://community.splunk.com/t5/Splunk-Search/Day-to-day-comparison-Using-stats-and-timechart/m-p/420463#M170754 <P>This is a very expensive search, you should look into leaning it out</P> Thu, 13 Jun 2019 14:52:04 GMT https://community.splunk.com/t5/Splunk-Search/Day-to-day-comparison-Using-stats-and-timechart/m-p/420463#M170754 skoelpin 2019-06-13T14:52:04Z