How to create a chart overlay of last weeks CPU utilization with this week's CPU utilization?

[tmarlette]

I am attempting to overlay last weeks CPU with this weeks CPU utilization, to give a side by side contrast.

Currently, I have the following:

sourcetype="mySourcetype" earliest=-7d@d latest=now | eval ReportKey="ThisWeek" | append [search sourcetype="mySourcetype"  earliest=-14d@d latest=-7d@d| eval ReportKey="LastWeek"  ] | timechart span=1d avg(pctCPU) by ReportKey

Which produces this chart: (I substituted minutes for days in the chart so it wouldn't take long to load)

Is there a way I can make this go over the same 'time', so it looks like a true over lay? Meaning if I set this to a weekly, Mon - Fri kind of time range?

[ramdaspr]

Or, you can shift time back for the second graph instead.
Refer a blog article covering this exact scenario

[MuS · Accepted solution]

Hi tmarlette,

try the timewrap app https://splunkbase.splunk.com/app/1645/ it does exactly what you want.

cheers, MuS