Working on a search where data from 2 different time range is to be compared and displayed on time chart. I have 2 searches which pulls number of events with timespan =1d, now I have to compare the values between those ranges.
Search 1: index=firewall dest_port=22 earliest=-39d@d latest=-21d@d | timechart span=1d count
Search 2: index=firewall dest_port=22 earliest=-21d@d latest=now | timechart span=1d count
So what I am trying to do is look at the port activity from 2 weeks (lets say End of April - Mid May and Mid May to until now) then compare the activity.
I looked at some of the previous posts and blogs, eeven used the timewrap (probably not the right way) but didnt quite worked out.
This is similar to an example in the Exploring Splunk book https://www.splunk.com/pdfs/exploring-splunk.pdf
sourcetype=access_combined earliest=-2d@d latest=@d
| eval marker = if (_time < relative_time(now(), "-1d@d"),
"last week", "this week")
| eval _time = if (marker=="last week",
_time + 24*60*60, _time)
| timechart avg(bytes) by marker
Modify it to fit your time frames and your base search, but the concept should help you.
How about timewrap ? Which one will be more efficient ?