line chart comparison between yesterday and todays data

[selvam_sekar]

Hi,

I have requirement to show the line chart comparison between todays count vs previous day. And, I have below SPL but we see the data from yesterday and today, and each graph line is separate.

 I want to see the lines together, one superimposed on the other. please could you suggest?

please can you suggest to compare them?

Current SPL:  

basesearch earliest=-1d@d latest=now
| eval Day=if(_time<relative_time(now(),"@d"),"Yesterday","Today")
| timechart span=15m count by Day

Current visualization:

Expected visualization is:

[isoutamo · Accepted solution]

Hi

have you look timewrap command?

You could try something like 

basesearch earliest=-1d@d latest=now
| timechart span=15m count
| timewrap d 

Your result shows little bit weird as yesterday you have a whole day, but today is only from midnight to now.

r. Ismo 

[selvam_sekar]

Thanks @isoutamo . How do we get the comparison between today vs yesterday with some time line.

Currently I am getting yesterday whole day(24 hrs) but today midnight to upto now. 

is it possible for us to bring only today (midnight till now) vs same timeframe previous day in the chart?

Current SPL:

basesearch earliest=-1d@d latest=now
| timechart span=1h count
| timewrap d series=short
| fields _time s1 s0
| rename s1 as today, s0 as yesterday

[isoutamo]

Maybe not exactly what you are looking, but at least you could cleared out (set to 0) those events like

basesearch earliest=-1d@d latest=now
| eval takeIn = case (_time>=relative_time(now(),"@d") ,"take",
                      _time<=relative_time(now(), "-1d"), "take",
                      true(), "drop")
| where takeIn = "take"
| timechart span=1h count
| timewrap d series=short
| fields _time s1 s0
| rename s1 as today, s0 as yesterday

[selvam_sekar]

Thanks @isoutamo . This works as expected 🙂 and only thing is not grouping the the user_id but rather it's grouping by timeformat/_time every 1 hr.

is it possible to group by user_id?

current spl:

base search | rex user_id

| eval takeIn = case (_time>=relative_time(now(),"@d") ,"take",
_time<=relative_time(now(), "-1d"), "take",
true(), "drop")
| where takeIn = "take"
| timechart span=1h count
| timewrap d series=short
| fields _time s1 s0 
| rename s1 as today, s0 as yesterday | where today !=""