Compare week and last week by host

[nravichandran]

I am trying to improve on the query below to show timechart by host for last week and this week. When I do "by host" it is not showing last week comparision. here is the query:
sourcetype=permon host="abc*" earliest=-2w@w latest=@w|eval marker = if(_time < relative_time(now(),"-1w@w"),"last week","this week")|eval _time = if(marker == "last week", _time + 7*24*60*60,_time) | timechart span=15m avg(PercentProcessorTime) as AvgPercentProcessorTime by marker (here how to do by host and by marker)

[nravichandran]

Unfortunately I cannot use timewrap as I cannot import the app. Is there any other way to get the desired result?

[woodcock]

Timewrap:
https://splunkbase.splunk.com/app/1645/

[nravichandran]

Unfortunately I cannot use this app as I am a normal user of splunk in my organization.

[woodcock]

Even if you cannot use the app, you can download it and look at the code, searches, macros, etc. and learn how it works. It is actually somewhat complicated to do what you are trying to do and look at how Timewrap works will be a huge help in you getting it done, even without being able to install it. Also, depending on what privileges you do have, you might very well be able to recreate the app by copying and adding all of the Knowledge Objects by hand.