How to create a timechart that makes same search run for a different date range in a single chart

[nkumar6]

I have a search string that runs a SQL search and returns two columns (items and count) from DB.
I run this search on a dashboard for checking today's count vs last week count

i.e. making the same search run for a different date range, one for today and one for -7d@d.

index=abc source=item_count 
|dedup item
|table item,count
|sort item

I want to make a timechart where I can compare it in a single chart rather than running two searches side by side.

[nikita_p]

Hi nkumar6,
You can try the search below for last 7 days to compare 7 days data.
Splunk Query: index=abc source=item_count |dedup item | timechart span=1d count by item

[oscar84x · Accepted solution]

Hi. you can try a subsearch to get the results from the previous week and then appending the results to the outer search for the current day. It's difficult not having the actual data but the search below might do the trick.

 index=abc source=item_count earliest=@d latest=now
 |dedup item
 |table item,count
 |sort item
 | rename count as TodayCount
    |appendcols [search index=abc source=item_count earliest=-7d@d latest=-6d@d
    |dedup item
    |table item,count
    |sort item
    | rename count as lastWeekCount
    | fields lastWeekCount]

[nkumar6]

Thanks, It worked.

[oscar84x]

Great! Glad to help.