Splunk Search

Relating data with time

prettysunshinez
Explorer

Hi,
I would like to view today and yesterday data in the same chart for the required time range.

How can that be done.
Help required!
Thanks!

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can use the timewrap command to do this, e.g.

index=_internal earliest=-4h
| timechart span=1m count 
| timewrap 1h

and it will generate 4 series, one for each hour on the same chart overlayed on top with the x-axis showing the last hour

0 Karma

to4kawa
Ultra Champion

add |where _time > relative_time(now(), "@d+6h") AND _time < relative_time(now(), "@d+12h")

0 Karma

prettysunshinez
Explorer

@to4kawa I would like to view for any specified Time range.
Time range is not fixed

0 Karma

to4kawa
Ultra Champion

make dashboard and token, so use this logic.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...