How to plot data for two different time ranges in the same visualization?

[mrncst]

Hello, word!

I've started with Splunk a few days ago and still have a lot of questions.

I'd like to plot on the same graphic two different date ranges for the same metric (count by id). My aim is to compare two different scenarios around the same data (represented by an id), before and after a ux change in the website. Can you please help me?

[landen99]

Here is a much more elegant solution which can plot all days on the same day in timechart:

| eval series=strftime(_time, "%m-%d") | eval time_delta=(now-_time)/86400,time_day=ceiling(time_delta),_time=_time+time_day*86400 | eval day=case(time_day=0,"Today",time_day=1,"Yesterday",time_day=8,"SD last week") | timechart fixedrange=false sum(count) by day

This allows you to plot any time range by series or to assign nice names in the case statement to each day based on its relation to the current time/day. 86400 is the number of seconds in a day.

[Raghav2384]

Hey There,

there are tons of posts on how to achieve this functionality.

http://blogs.splunk.com/2012/02/19/compare-two-time-ranges-in-one-report/ by Jon Webster

There is an app called Time Wrap in the splunk app base. Hope this will walk you in the right direction.

Thanks,
Raghav

[mrncst]

Thank you for your time!

I'm following the post instructions and my search displays a visualization but the lines aren't superimposed:

My search query:

index=ux app=* country=BRA type=UIInputError id=client-first-name earliest=-2d@d latest=-1d@d | eval ReportKey="today" | append [search index=ux app=* country=BRA type=UIInputError id=client-first-name earliest=-4d@d latest=-3d@d | eval ReportKey="yesterday"| eval _time=_time+60*60*24] | timechart span=10m count(id) by ReportKey

[Raghav2384]

Please accept as answer / leave comments so that it would be easier for others to see the post.

Thanks,
Raghav

[somesoni2]

The time difference between two searches is 2 days. Update your time adjustment to 2 days

| eval _time =  _time + 2*86400