Comparing two searches from separate time ranges while still having a clean chart

[bencooper1]

Hello,

I am trying to compare two time windows in the same index but I would like the chart comparing them to be based on a specified name of those time ranges rather than on time.

For example:

Release_A = October 2nd
Release_B = September 20th

(index=.... url=* earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url=* earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59")
| chart avg(seconds) by _time span=1d

I want the chart x-axis values to be Release_A and Release_B rather than a timeline.
Any advice on how to do this would be very appreciated.

[mayurr98 · Accepted solution]

try this:

(index=.... url= earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59") 
| chart avg(seconds) by _time span=1d 
| convert ctime(_time) timeformat="%B %d"

OR

(index=.... url= earliest="10/02/2019:00:00:00" latest="10/02/2019:23:59:59") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/20/2019:23:59:59") 
| eval time=case(date_mday="2","Release_A",date_mday="20","Release_B") 
| chart avg(seconds) by time

[bencooper1]

That helped a lot and I will definitely be using that eval-case command in the future.
Thank you!

[to4kawa]

(index=.... url= earliest="10/02/2019:00:00:00" latest="10/03/2019:00:00:00") OR (index=... url= earliest="09/20/2019:00:00:00" latest="09/21/2019:00:00:00")
| timechart avg(seconds)  span=1d

Hi, try timechart