Splunk Search

Plot data for two different time ranges in the same visualization?

bigll
Path Finder

Hi.

I found old article on the subject and followed, but I do not see overlaying charts.
My SPL
-------------
index=firewall sourcetype="collector" fqdn="fw.myorg.com" earliest=-2d@d latest=-1d@d
| multikv
| eval ReportKey=today
| append [search index=firewall sourcetype="collector" fqdn="fw.myorg.com" earliest=-4d@d latest=-3d@d
| multikv
| eval ReportKey=yesterday
| eval _time = _time + 2*86400]
| timechart span=1H count by ReportKey

-------------
So I expect it would report by ReportKey instead it shows by NULL
---
chart1.jpg
-------------
chart.jpg

Labels (4)
Tags (2)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

A simple mistake. You forgot quotes around values you want to assign to the ReportKey field so Splunk treats those values as field names. As you apparently have no such fields in yoir data you end up with empty (null) values.

View solution in original post

bigll
Path Finder

I think I got it.
Need properly configure "_time" depend on difference in days i.e. for week long difference 
eval _time = _time + 7*86400.

If I am wrong, please advise.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You can also try to fiddle with the timewrap command (but that's just a general idea, I don't have any particular solution in mind at the mkment).

0 Karma

bigll
Path Finder

I see report by ReportKey now, but graph is leaner I wonder how I can get something like one in articale.
image1small[1].png

0 Karma

bigll
Path Finder

Thank you very much.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

A simple mistake. You forgot quotes around values you want to assign to the ReportKey field so Splunk treats those values as field names. As you apparently have no such fields in yoir data you end up with empty (null) values.

Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...