How do I make a column chart that compares the result from last year with this year by month?

[MCH2018]

Hi everyone,

I would like to make a chart that compares the result from last year with this year by month.

This is my search :

...| dedup CaseNumber | search ProductName=* IsDeleted=False  AccountName="*" CaseRecordTypeName=Standard | eval CreatedDateUNIX=strptime(CreatedDate,"%Y-%m-%d %H:%M:%S") | eval _time=CreatedDateUNIX  | where _time>=strptime("2017-01-01 00:00:00","%Y-%m-%d %H:%M:%S") AND _time<=strptime("2017-12-31 23:59:59","%Y-%m-%d %H:%M:%S") | timechart span=1mon count as 2017 | appendcols [dedup CaseNumber | search ProductName=* IsDeleted=False  AccountName="*" CaseRecordTypeName=Standard | eval CreatedDateUNIX=strptime(CreatedDate,"%Y-%m-%d %H:%M:%S") | eval _time=CreatedDateUNIX | eval date=_time | eval today=round(relative_time(now(),"@y")) | where date>today | timechart span=1mon count as 2018]

Both searches work well separately, but when i try to combine them, I only see the 2017 data.

If someone could help me, that would be great. I'll be grateful.

[woodcock]

Did you get a solution, @MCH2018?

[woodcock]

You need the timewrap span=1m command, see documentation here:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timewrap

[efavreau]

I agree. Timewrap is the shortcut needed here. If the op wants to see an example of that, look here: https://answers.splunk.com/answers/145458/can-timewrap-be-utilized-to-only-use-weekdays.html

[cmerriman]

what if you just did ...| dedup CaseNumber | search ProductName=* IsDeleted=False AccountName="*" CaseRecordTypeName=Standard | eval CreatedDateUNIX=strptime(CreatedDate,"%Y-%m-%d %H:%M:%S")| eval _time=CreatedDateUNIX|timechart span=1mon count|timewrap 1y and maybe any other filtering you might want to get last year to now. i see you have that in the first search to grab 2017 and you have a different filter to grab 2018.