Hi Experts,
I want to compare two weeks data by keeping week1 count in row1 and week2 count in row2.
Eg. index=* vip="abc.com:9001" | timechart span=1w count by user
My desired output should be
**_time user1 user2 user3**
**07/11/2018 10 20 30
07/18/2018 50 60 70**
Like this:
index=* vip="abc.com:9001" earliest=-2w@d latest=@d | timechart span=1w count BY user
Open the time range picker, go to advanced, use -2w@d
and @d
to search the past two weeks, snapped to midnight. Adjust if you want whole weeks, e.g. snapped to start of Monday: -2w@w1
and @w1
.
If you select the right time range, your query should work. Is it not giving you the correct output?
I can select time range only either first week or second week but not combinely both. I want the results for 1st week and 2nd week in two different rows