Plot data for two different time ranges in the same visualization?

[bigll]

Hi.

I found old article on the subject and followed, but I do not see overlaying charts.
My SPL
-------------
index=firewall sourcetype="collector" fqdn="fw.myorg.com" earliest=-2d@d latest=-1d@d
| multikv
| eval ReportKey=today
| append [search index=firewall sourcetype="collector" fqdn="fw.myorg.com" earliest=-4d@d latest=-3d@d
| multikv
| eval ReportKey=yesterday
| eval _time = _time + 2*86400]
| timechart span=1H count by ReportKey

-------------
So I expect it would report by ReportKey instead it shows by NULL
---

-------------

[bigll]

I think I got it.
Need properly configure "_time" depend on difference in days i.e. for week long difference 
eval _time = _time + 7*86400.

If I am wrong, please advise.

[PickleRick]

You can also try to fiddle with the timewrap command (but that's just a general idea, I don't have any particular solution in mind at the mkment).

[bigll]

I see report by ReportKey now, but graph is leaner I wonder how I can get something like one in articale.

[bigll]

Thank you very much.

[PickleRick · Accepted solution]

A simple mistake. You forgot quotes around values you want to assign to the ReportKey field so Splunk treats those values as field names. As you apparently have no such fields in yoir data you end up with empty (null) values.