I am attempting to overlay last weeks CPU with this weeks CPU utilization, to give a side by side contrast.
Currently, I have the following:
sourcetype="mySourcetype" earliest=-7d@d latest=now | eval ReportKey="ThisWeek" | append [search sourcetype="mySourcetype" earliest=-14d@d latest=-7d@d| eval ReportKey="LastWeek" ] | timechart span=1d avg(pctCPU) by ReportKey
Which produces this chart: (I substituted minutes for days in the chart so it wouldn't take long to load)
Is there a way I can make this go over the same 'time', so it looks like a true over lay? Meaning if I set this to a weekly, Mon - Fri kind of time range?
try the timewrap app https://splunkbase.splunk.com/app/1645/ it does exactly what you want.
View solution in original post
Or, you can shift time back for the second graph instead.
Refer a blog article covering this exact scenario