How to get a year over year comparison in a search?

[myahes]

using this articles advice (http://blogs.splunk.com/2012/02/19/compare-two-time-ranges-in-one-report/)

i am trying to compare year over year using the following search

index="stacks" earliest=-2mon@mon latest=-1mon@mon| multikv| eval ReportKey="thisYear"| append [search index="stacks" earliest=-14mon@mon latest=-13mon@mon| multikv| eval ReportKey="lastYear"]| timechart distinct_count(Check_Number) AS Check_Count, sum(Amount) AS "Net_Sales" by ReportKey

this generates the side by side data fine. when I add the eval modifier (eval

index="stacks" earliest=-2mon@mon latest=-1mon@mon| multikv| eval ReportKey="thisYear"| append [search index="stacks" earliest=-14mon@mon latest=-13mon@mon| multikv| eval ReportKey="lastYear" | eval _time=_time+60*60*24*365]| timechart distinct_count(Check_Number) AS Check_Count, sum(Amount) AS "Net_Sales" by ReportKey

The previous years data craps out.

Any idea what i am doing wrong?

[gkanapathy]

It might be easier to use this app by David Carasso, Timewrap.

https://apps.splunk.com/app/1645/

[myahes]

thank for responding. have you used it? i have tried using the timewrap y command and it doesnt work for me. only get the current year returned.