I am displaying some data by Month for 2018/2019 (i.e. 01-2018, 02-2018) on a barchart.
( sourcetype=sourcetype1) OR (sourcetype=sourcetype2) OR (sourcetype=sourcetype3)
| chart sum(eval(if(sourcetype="sourcetype1",ICOS,NULL))) as Actuals sum(eval(if(sourcetype="sourcetype2",ICOS,NULL))) as Forecast sum(eval(if(sourcetype="sourcetype3",ICOS,NULL))) as Budget over "Month"
However I also want to be able to overlay 2017 data so that 2017-01 is shown above 2018-01 without adding to the x-axis.
Here is a technique from Exploring Splunk by David Carasso. I recommend downloading this since it has several good examples in it. This search shows how to compare last weeks results to this weeks results on the same chart, by labeling data from last week and this week, then adjusting _time so they line up for charting.
Added below to search and has worked 🙂 | appendcols
[ search index=finance sourcetype=hfm_actuals Country1="EMEIA" AND Organisation="DTS_DWS" "Financial Year ending"=2018
| eval _time=relative_time((_time),"+1year")
| chart sum(ICOS) as "FY18 Actuals" over Month]