How to modify my search to graph the same 30 minute time period for previous weeks on the same graph?

[tmurray3]

I have a search to graph the last 30 minutes in 5 minute intervals:

index=web_summary report="volumebyminuteweb" earliest=-30m@m latest=now | bucket _time span=5m|stats count by _time |timechart span=5m sum(count)

I would like to also graph the same time period for the previous 7, 14, 21, and 28 days on the same graph.

How would I modify the query to include the additional time periods?

Thanks in advance for your assistance.

[twinspop · Accepted solution]

Appendcols is what you want. You don't need the bucket and stats commands, just timechart:

index=web_summary report="volumebyminuteweb" earliest=-30m@m latest=@m |timechart span=5m count as Today | 
appendcols [ 
    search index=web_summary report="volumebyminuteweb" earliest=-30m@m-1w latest=@m-1w |timechart span=5m count as "1 week ago" ] |
appendcols [ 
    search index=web_summary report="volumebyminuteweb" earliest=-30m@m-2w latest=@m-2w |timechart span=5m count as "2 weeks ago" ] | 
appendcols [
    search index=web_summary report="volumebyminuteweb" earliest=-30m@m-3w latest=@m-3w |timechart span=5m count as "3 weeks ago" ]