https://community.splunk.com/t5/Splunk-Search/Time-over-Time-comparison/m-p/92271#M23812 <P>What exactly do you mean by "over lapping each other"?</P> <P>You have all the data you need in the chart. Play around with the different display options to get the one you want.</P> <P>When I use today vs same day last week sort of comparisons, I find line charts the most effective displays. That's just one example though.</P> Thu, 11 Jul 2013 14:22:27 GMT aholzer 2013-07-11T14:22:27Z https://community.splunk.com/t5/Splunk-Search/Time-over-Time-comparison/m-p/92270#M23811 <P>Is there a way to search over a set of data from lets say a month ago and then lay it on top of the same set of data from last week? I have found a search that will put the two data sets on the same graph, but I want them over lapping each other.</P> <P>msmqintermediate earliest=-1h@m latest=@m<BR /><BR /> | eval ReportKey="today"<BR /><BR /> | append maxtime=600 [search msmqintermediate earliest=-169h@m latest=-7d@m<BR /><BR /> | eval ReportKey="last week"]<BR /><BR /> | eval _time=if(ReportKey=="last week",_time+606024*7,_time)<BR /><BR /> | timechart span=1m count by ReportKey </P> <P>Thank you</P> Mon, 28 Sep 2020 14:19:16 GMT https://community.splunk.com/t5/Splunk-Search/Time-over-Time-comparison/m-p/92270#M23811 JoeSco27 2020-09-28T14:19:16Z https://community.splunk.com/t5/Splunk-Search/Time-over-Time-comparison/m-p/92271#M23812 <P>What exactly do you mean by "over lapping each other"?</P> <P>You have all the data you need in the chart. Play around with the different display options to get the one you want.</P> <P>When I use today vs same day last week sort of comparisons, I find line charts the most effective displays. That's just one example though.</P> Thu, 11 Jul 2013 14:22:27 GMT https://community.splunk.com/t5/Splunk-Search/Time-over-Time-comparison/m-p/92271#M23812 aholzer 2013-07-11T14:22:27Z https://community.splunk.com/t5/Splunk-Search/Time-over-Time-comparison/m-p/92272#M23813 <P>I want them laying on top of each other rather then end to end next to each other on the timechart.</P> Thu, 11 Jul 2013 14:23:20 GMT https://community.splunk.com/t5/Splunk-Search/Time-over-Time-comparison/m-p/92272#M23813 JoeSco27 2013-07-11T14:23:20Z https://community.splunk.com/t5/Splunk-Search/Time-over-Time-comparison/m-p/92273#M23814 <P>Here are some detailed instructions on how to do exactly what you want: <STRONG><A href="http://blogs.splunk.com/2012/02/19/compare-two-time-ranges-in-one-report/">Splunk Blogs: Compare two time ranges on the same chart</A></STRONG></P> Thu, 11 Jul 2013 15:33:33 GMT https://community.splunk.com/t5/Splunk-Search/Time-over-Time-comparison/m-p/92273#M23814 wpreston 2013-07-11T15:33:33Z