topic Re: How to modify my search to graph the same 30 minute time period for previous weeks on the same graph? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-to-graph-the-same-30-minute-time-period/m-p/272072#M81864 <P>Appendcols is what you want. You don't need the bucket and stats commands, just timechart:</P> <PRE><CODE>index=web_summary report="volumebyminuteweb" earliest=-30m@m latest=@m |timechart span=5m count as Today | appendcols [ search index=web_summary report="volumebyminuteweb" earliest=-30m@m-1w latest=@m-1w |timechart span=5m count as "1 week ago" ] | appendcols [ search index=web_summary report="volumebyminuteweb" earliest=-30m@m-2w latest=@m-2w |timechart span=5m count as "2 weeks ago" ] | appendcols [ search index=web_summary report="volumebyminuteweb" earliest=-30m@m-3w latest=@m-3w |timechart span=5m count as "3 weeks ago" ] </CODE></PRE> Tue, 13 Dec 2016 15:25:12 GMT twinspop 2016-12-13T15:25:12Z How to modify my search to graph the same 30 minute time period for previous weeks on the same graph? https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-to-graph-the-same-30-minute-time-period/m-p/272071#M81863 <P>I have a search to graph the last 30 minutes in 5 minute intervals:</P> <PRE><CODE>index=web_summary report="volumebyminuteweb" earliest=-30m@m latest=now | bucket _time span=5m|stats count by _time |timechart span=5m sum(count) </CODE></PRE> <P>I would like to also graph the same time period for the previous 7, 14, 21, and 28 days on the same graph.</P> <P>How would I modify the query to include the additional time periods?</P> <P>Thanks in advance for your assistance.</P> Tue, 13 Dec 2016 15:16:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-to-graph-the-same-30-minute-time-period/m-p/272071#M81863 tmurray3 2016-12-13T15:16:52Z Re: How to modify my search to graph the same 30 minute time period for previous weeks on the same graph? https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-to-graph-the-same-30-minute-time-period/m-p/272072#M81864 <P>Appendcols is what you want. You don't need the bucket and stats commands, just timechart:</P> <PRE><CODE>index=web_summary report="volumebyminuteweb" earliest=-30m@m latest=@m |timechart span=5m count as Today | appendcols [ search index=web_summary report="volumebyminuteweb" earliest=-30m@m-1w latest=@m-1w |timechart span=5m count as "1 week ago" ] | appendcols [ search index=web_summary report="volumebyminuteweb" earliest=-30m@m-2w latest=@m-2w |timechart span=5m count as "2 weeks ago" ] | appendcols [ search index=web_summary report="volumebyminuteweb" earliest=-30m@m-3w latest=@m-3w |timechart span=5m count as "3 weeks ago" ] </CODE></PRE> Tue, 13 Dec 2016 15:25:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-to-graph-the-same-30-minute-time-period/m-p/272072#M81864 twinspop 2016-12-13T15:25:12Z