How do you use timewarp in specific?

[phamxuantung]

Let's say I have this query

index = x 
|stats count as Total, sum(AMMOUNT) as TAmmount BY MERCHANT, SUBMERCHANT

I want to make a comparison by percentage between this month to the average of TOTAL three month ago. How do you go about using timewarp to  archive that goal?

[tread_splunk]

You can adapt this.  I don't have months of data on my laptop.  So I've produced a chart with 2 lines.  One line is the last minute of activity (count of events per second), the other line is the average activity based on the 4 minutes before that.

index=_internal sourcetype=splunkd component=Metrics earliest=-5min@min latest=@min
| timechart span=1s count
| eval latestMinute=if(_time>=relative_time(now(),"-1m@m"),"LatestMinute","Average"), sec=strftime(_time,"%S")
| chart avg(count) over sec by latestMinute

[PickleRick]

For timewrap you need results of timechart.