Splunk Search

Time over Time comparison

JoeSco27
Communicator

Is there a way to search over a set of data from lets say a month ago and then lay it on top of the same set of data from last week? I have found a search that will put the two data sets on the same graph, but I want them over lapping each other.

msmqintermediate earliest=-1h@m latest=@m

| eval ReportKey="today"

| append maxtime=600 [search msmqintermediate earliest=-169h@m latest=-7d@m

| eval ReportKey="last week"]

| eval _time=if(ReportKey=="last week",_time+606024*7,_time)

| timechart span=1m count by ReportKey

Thank you

0 Karma
1 Solution

wpreston
Motivator

Here are some detailed instructions on how to do exactly what you want: Splunk Blogs: Compare two time ranges on the same chart

View solution in original post

wpreston
Motivator

Here are some detailed instructions on how to do exactly what you want: Splunk Blogs: Compare two time ranges on the same chart

View solution in original post

JoeSco27
Communicator

I want them laying on top of each other rather then end to end next to each other on the timechart.

0 Karma

aholzer
Motivator

What exactly do you mean by "over lapping each other"?

You have all the data you need in the chart. Play around with the different display options to get the one you want.

When I use today vs same day last week sort of comparisons, I find line charts the most effective displays. That's just one example though.

0 Karma