https://community.splunk.com/t5/Splunk-Search/Plot-data-for-two-different-time-ranges-in-the-same/m-p/681267#M232805 <P>You can also try to fiddle with the timewrap command (but that's just a general idea, I don't have any particular solution in mind at the mkment).</P> Tue, 19 Mar 2024 21:21:05 GMT PickleRick 2024-03-19T21:21:05Z https://community.splunk.com/t5/Splunk-Search/Plot-data-for-two-different-time-ranges-in-the-same/m-p/681255#M232800 <P>Hi.<BR /><BR />I found old article on the subject and followed, but I do not see overlaying charts.<BR />My SPL<BR />-------------<BR />index=firewall sourcetype="collector" fqdn="fw.myorg.com" earliest=-2d@d latest=-1d@d<BR />| multikv<BR />| eval ReportKey=today<BR />| append [search index=firewall sourcetype="collector" fqdn="fw.myorg.com" earliest=-4d@d latest=-3d@d<BR />| multikv<BR />| eval ReportKey=yesterday<BR />| eval _time = _time + 2*86400]<BR />| timechart span=1H count by ReportKey</P><P>-------------<BR />So I expect it would report by ReportKey instead it shows by NULL<BR />---<BR /><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="chart1.jpg" style="width: 162px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/29811iA5D2A8BD9EC26914/image-size/large?v=v2&amp;px=999" role="button" title="chart1.jpg" alt="chart1.jpg" /></span><BR />-------------<BR /><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="chart.jpg" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/29810i29E382C53727A2CC/image-size/large?v=v2&amp;px=999" role="button" title="chart.jpg" alt="chart.jpg" /></span></P> Tue, 19 Mar 2024 20:24:25 GMT https://community.splunk.com/t5/Splunk-Search/Plot-data-for-two-different-time-ranges-in-the-same/m-p/681255#M232800 bigll 2024-03-19T20:24:25Z https://community.splunk.com/t5/Splunk-Search/Plot-data-for-two-different-time-ranges-in-the-same/m-p/681256#M232801 <P>A simple mistake. You forgot quotes around values you want to assign to the ReportKey field so Splunk treats those values as field names. As you apparently have no such fields in yoir data you end up with empty (null) values.</P> Tue, 19 Mar 2024 20:35:38 GMT https://community.splunk.com/t5/Splunk-Search/Plot-data-for-two-different-time-ranges-in-the-same/m-p/681256#M232801 PickleRick 2024-03-19T20:35:38Z https://community.splunk.com/t5/Splunk-Search/Plot-data-for-two-different-time-ranges-in-the-same/m-p/681257#M232802 <P>Thank you very much.</P> Tue, 19 Mar 2024 20:39:52 GMT https://community.splunk.com/t5/Splunk-Search/Plot-data-for-two-different-time-ranges-in-the-same/m-p/681257#M232802 bigll 2024-03-19T20:39:52Z https://community.splunk.com/t5/Splunk-Search/Plot-data-for-two-different-time-ranges-in-the-same/m-p/681261#M232803 <P>I see report by&nbsp;<SPAN>ReportKey now, but graph is leaner I wonder how I can get something like one in articale.<BR /><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image1small[1].png" style="width: 600px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/29812i13C40235CC0ADCF8/image-size/large?v=v2&amp;px=999" role="button" title="image1small[1].png" alt="image1small[1].png" /></span><BR /></SPAN></P> Tue, 19 Mar 2024 20:48:22 GMT https://community.splunk.com/t5/Splunk-Search/Plot-data-for-two-different-time-ranges-in-the-same/m-p/681261#M232803 bigll 2024-03-19T20:48:22Z https://community.splunk.com/t5/Splunk-Search/Plot-data-for-two-different-time-ranges-in-the-same/m-p/681264#M232804 <P>I think I got it.<BR />Need properly configure "_time" depend on difference in days i.e. for week long difference&nbsp;<BR />eval _time = _time + 7*86400.<BR /><BR />If I am wrong, please advise.<BR /><BR /></P> Tue, 19 Mar 2024 21:00:44 GMT https://community.splunk.com/t5/Splunk-Search/Plot-data-for-two-different-time-ranges-in-the-same/m-p/681264#M232804 bigll 2024-03-19T21:00:44Z https://community.splunk.com/t5/Splunk-Search/Plot-data-for-two-different-time-ranges-in-the-same/m-p/681267#M232805 <P>You can also try to fiddle with the timewrap command (but that's just a general idea, I don't have any particular solution in mind at the mkment).</P> Tue, 19 Mar 2024 21:21:05 GMT https://community.splunk.com/t5/Splunk-Search/Plot-data-for-two-different-time-ranges-in-the-same/m-p/681267#M232805 PickleRick 2024-03-19T21:21:05Z