Overlaping Days with Timecharts

[achudnoff]

I'm looking to make a line chart that has several days over data superimposed over each other so that I can see the trend of an event over the course of a day.

Currently my Search term is:

index="prd_common_events" EventName="ExceptionEventETL" | timechart span=1h count by date_mday

When I set it to 7 days, it gives me each of the days in a different color. Is there a way I can offset them so they are all rendered on the same graph of 24 hours?

[Ayn · Accepted solution]

Instead of timechart you can use chart and have it chart over date_hour to get per-hour stats for each of your weekdays.

index="prd_common_events" EventName="ExceptionEventETL" | chart count over date_hour by date_wday