I have the following query where I am trying to utilize timewrap to display the total number of credit cards used as a payment method today, yesterday, and compare it to the 7 day average.
base search...
| payment_method=credit_card
| timechart count span=1h
| timewrap d series=short
| addtotals s*
| eval 7dayavg=Total/7.0
| table _time, _span, s0, s1, 7dayavg
| rename s0 as now, s1 as yesterday
The problem is currently that the legend shows 4 data series labeled 6:00 PM - 12:00 AM, 12:00 AM - 6:00 AM, 6:00 AM - 12:00 PM, 12:00 PM - 6:00 PM when I would like for it to be today, yesterday, and 7dayavg. The x-axis barely starts from 6:00 pm however I would like it to start from the beginning of the day today (midnight) compared to the beginning of the day yesterday (midnight), with the 7 day average at midnight.
Thank you
In this above query i want to include prior week like last 14 days and instead of 7dayavg i want eventcount
It's giving you that because you have fed it data at the hourly basis, so it is assuming you care about hours. If you are trying to calculate on a daily basis, rather than hourly, change this line -
| timechart count span=1h
to
| timechart count span=1d
Thank you for your response. I realize I wasn't very clear in my question. To clarify, I am using the custom timewrap extension and would like a graph to display on the x-axis the hours against today, yesterday, and the 7-day average.
Essentially, I would see three lines going across with a data point at each hour (01, 02, 03, 04...- .. 22, 23).