How to compare year to date values against last year

[DCUpro]

Hi all,

I'm looking to create a simple bar chart that compares the monthly data from this year against the monthly data of last year.

This search seems to do the job for me but unfortunately it also shows the data for all of the months in 2019.

... | timechart count span=1mon | timewrap 1y

Ideally I would like to only compare year to date data of 2020 with 2019. Has anyone any tips on how I might achieve this?

Thanks for the help.

[DCUpro]

Thanks All,

I was able to figure it out using @thambisetty answer.

[isoutamo]

Hi
Here is older conf presentation about this https://conf.splunk.com/files/2016/slides/time-after-time-comparing-time-ranges-in-splunk.pdf
With append and sub queries you must remember those limits: 60s and 500000 events!
r. Ismo

[thambisetty · Accepted solution]

below is the example to show yesterdays 11-12 hours count and todays 11-12hours count. you can modify below query.

index=_internal earliest="09/14/2020:11:00:00" latest="09/14/2020:12:00:00" 
| eval when="yesterday_11-12h" 
| append 
    [ search index=_internal earliest="09/15/2020:11:00:00" latest="09/15/2020:12:00:00" 
    | eval when="today_11-12h"] 
| bin span=1h _time
| eval Time=strftime(_time,"%H:%M")
| chart count over Time by when