Time over Time comparison

[JoeSco27]

Is there a way to search over a set of data from lets say a month ago and then lay it on top of the same set of data from last week? I have found a search that will put the two data sets on the same graph, but I want them over lapping each other.

msmqintermediate earliest=-1h@m latest=@m

| eval ReportKey="today"

| append maxtime=600 [search msmqintermediate earliest=-169h@m latest=-7d@m

| eval ReportKey="last week"]

| eval _time=if(ReportKey=="last week",_time+606024*7,_time)

| timechart span=1m count by ReportKey

Thank you

[wpreston · Accepted solution]

Here are some detailed instructions on how to do exactly what you want: Splunk Blogs: Compare two time ranges on the same chart

[JoeSco27]

I want them laying on top of each other rather then end to end next to each other on the timechart.

[aholzer]

What exactly do you mean by "over lapping each other"?

You have all the data you need in the chart. Play around with the different display options to get the one you want.

When I use today vs same day last week sort of comparisons, I find line charts the most effective displays. That's just one example though.