Is it possible to display weekly as well as daily data on the same chart? Eg. Three weeks data with sub-scale of 7 days each.
No, I want 3 weeks graph with 21 lines(7*3), ie. each week average data with granularity of single day data.
You can use the append command to group results of different searches over different time periods.
example :
search_from_today earliest=@d latest=now | stats avg(myfield) AS today_average | append [ search_from_last_week earliest=-2w@w latest=-1w@w | stats avg(myfield) AS lastweek_average ] | table today_average lastweek_average
see http://splunk-base.splunk.com/answers/40071/append-comparison-to-1-week-earlier-with-timechart-by
Can you explain in more detail how the graph would look ? i.e. is it a graph from monday - sunday, with 3 lines, 1 for each of the last 3 weeks ?
