https://community.splunk.com/t5/Splunk-Search/Timechart-Graph-extends-into-the-future/m-p/181679#M52355 <P>I'd strongly suggest you use the <A href="http://apps.splunk.com/app/1645/">timewrap</A> command for this use case. The documentation should give you some guidance on how to contruct the searches you are after.</P> Tue, 17 Dec 2013 21:18:19 GMT dart 2013-12-17T21:18:19Z https://community.splunk.com/t5/Splunk-Search/Timechart-Graph-extends-into-the-future/m-p/181678#M52354 <P>index=summary_security earliest=-1d@d latest=now orig_sourcetype=dhcp | timechart count by orig_sourcetype | eval marker = "today" | eval _time = _time+1800 | append [search index=summary_security earliest=-7d@d latest=-6d@d orig_sourcetype=dhcp | timechart count by orig_sourcetype | eval marker = "last week" | eval _time = _time+86400*7+1800] | timechart sum(dhcp) by marker</P> <P>I'm using the above search in order to create a week over week comparison of my sourcetype counts. The problem is that my "last week" data flatlines after the day i'm looking at and continues for a week into the future creating a bunch of white space in my graph. </P> <P>Any ideas how to solve this one?</P> Mon, 28 Sep 2020 15:30:17 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-Graph-extends-into-the-future/m-p/181678#M52354 tprzelom 2020-09-28T15:30:17Z https://community.splunk.com/t5/Splunk-Search/Timechart-Graph-extends-into-the-future/m-p/181679#M52355 <P>I'd strongly suggest you use the <A href="http://apps.splunk.com/app/1645/">timewrap</A> command for this use case. The documentation should give you some guidance on how to contruct the searches you are after.</P> Tue, 17 Dec 2013 21:18:19 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-Graph-extends-into-the-future/m-p/181679#M52355 dart 2013-12-17T21:18:19Z https://community.splunk.com/t5/Splunk-Search/Timechart-Graph-extends-into-the-future/m-p/181680#M52356 <P>index=summary_security earliest=@d latest=-30m orig_sourcetype=dhcp | timechart partial=f span=30m count by orig_sourcetype | eval marker = "today" | eval _time = _time+1800 | append [search index=summary_security earliest=-7d@d-30m latest=-6d@d-30m orig_sourcetype=dhcp | timechart partial=f span=30m count by orig_sourcetype | eval marker = "last_week" | eval _time = _time+86400*7+1800] | search NOT dhcp=0 | timechart partial=f span=30m avg(dhcp) by marker</P> <P>This is the final search I came up with. Adding in "search NOT dhcp=0" removed the extra portions of the graph.</P> Mon, 28 Sep 2020 15:30:42 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-Graph-extends-into-the-future/m-p/181680#M52356 tprzelom 2020-09-28T15:30:42Z