All Apps and Add-ons

Overlay two time based grouped results in a Chart






index=xy device_event_class_id=Bandwidth earliest=-1d@d latest=-0d@d  
| rex field=msg "msg=.+raffic.+'(?<pg_name>[\w\s\-]+)'.+(?<bps>\d+\.\d+\s.+)\..+"   
| eval ReportKey="yersterday" 
| timechart span=3h count by pg_name 
| append [search index=xy device_event_class_id=Bandwidth earliest=-2d@d latest=-1d@d 
| rex field=msg "msg=.+raffic.+'(?<pg_name>[\w\s\-]+)'.+(?<bps>\d+\.\d+\s.+)\..+"   
| eval ReportKey="beforeyesterday" 
| timechart span=3h count by pg_name  ] 
| fillnull value=0 
| eval mytime=strftime(_time, "%H:%M") 
| sort mytime





I'm trying to create a chart containing two timecharts for different time frames (today/yesterday). How can I achieve it?
Currently I'm getting it one after another. I'd like basically to overlay one timechart on another one.




Labels (3)
0 Karma

Ultra Champion

This was answered here 

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!