Let's say I have this query
index = x
|stats count as Total, sum(AMMOUNT) as TAmmount BY MERCHANT, SUBMERCHANT
I want to make a comparison by percentage between this month to the average of TOTAL three month ago. How do you go about using timewarp to archive that goal?
You can adapt this. I don't have months of data on my laptop. So I've produced a chart with 2 lines. One line is the last minute of activity (count of events per second), the other line is the average activity based on the 4 minutes before that.
index=_internal sourcetype=splunkd component=Metrics earliest=-5min@min latest=@min
| timechart span=1s count
| eval latestMinute=if(_time>=relative_time(now(),"-1m@m"),"LatestMinute","Average"), sec=strftime(_time,"%S")
| chart avg(count) over sec by latestMinute
For timewrap you need results of timechart.