Timechart Graph extends into the future

[tprzelom]

index=summary_security earliest=-1d@d latest=now orig_sourcetype=dhcp | timechart count by orig_sourcetype | eval marker = "today" | eval _time = _time+1800 | append [search index=summary_security earliest=-7d@d latest=-6d@d orig_sourcetype=dhcp | timechart count by orig_sourcetype | eval marker = "last week" | eval _time = _time+86400*7+1800] | timechart sum(dhcp) by marker

I'm using the above search in order to create a week over week comparison of my sourcetype counts. The problem is that my "last week" data flatlines after the day i'm looking at and continues for a week into the future creating a bunch of white space in my graph.

Any ideas how to solve this one?

[tprzelom · Accepted solution]

index=summary_security earliest=@d latest=-30m orig_sourcetype=dhcp | timechart partial=f span=30m count by orig_sourcetype | eval marker = "today" | eval _time = _time+1800 | append [search index=summary_security earliest=-7d@d-30m latest=-6d@d-30m orig_sourcetype=dhcp | timechart partial=f span=30m count by orig_sourcetype | eval marker = "last_week" | eval _time = _time+86400*7+1800] | search NOT dhcp=0 | timechart partial=f span=30m avg(dhcp) by marker

This is the final search I came up with. Adding in "search NOT dhcp=0" removed the extra portions of the graph.

[dart]

I'd strongly suggest you use the timewrap command for this use case. The documentation should give you some guidance on how to contruct the searches you are after.