index=summary_security earliest=-1d@d latest=now orig_sourcetype=dhcp | timechart count by orig_sourcetype | eval marker = "today" | eval _time = _time+1800 | append [search index=summary_security earliest=-7d@d latest=-6d@d orig_sourcetype=dhcp | timechart count by orig_sourcetype | eval marker = "last week" | eval _time = _time+86400*7+1800] | timechart sum(dhcp) by marker
I'm using the above search in order to create a week over week comparison of my sourcetype counts. The problem is that my "last week" data flatlines after the day i'm looking at and continues for a week into the future creating a bunch of white space in my graph.
Any ideas how to solve this one?
index=summary_security earliest=@d latest=-30m orig_sourcetype=dhcp | timechart partial=f span=30m count by orig_sourcetype | eval marker = "today" | eval _time = _time+1800 | append [search index=summary_security earliest=-7d@d-30m latest=-6d@d-30m orig_sourcetype=dhcp | timechart partial=f span=30m count by orig_sourcetype | eval marker = "last_week" | eval _time = _time+86400*7+1800] | search NOT dhcp=0 | timechart partial=f span=30m avg(dhcp) by marker
This is the final search I came up with. Adding in "search NOT dhcp=0" removed the extra portions of the graph.
index=summary_security earliest=@d latest=-30m orig_sourcetype=dhcp | timechart partial=f span=30m count by orig_sourcetype | eval marker = "today" | eval _time = _time+1800 | append [search index=summary_security earliest=-7d@d-30m latest=-6d@d-30m orig_sourcetype=dhcp | timechart partial=f span=30m count by orig_sourcetype | eval marker = "last_week" | eval _time = _time+86400*7+1800] | search NOT dhcp=0 | timechart partial=f span=30m avg(dhcp) by marker
This is the final search I came up with. Adding in "search NOT dhcp=0" removed the extra portions of the graph.
I'd strongly suggest you use the timewrap command for this use case. The documentation should give you some guidance on how to contruct the searches you are after.