Timechart and Timewrap

[scottmkirkland]

I am on Splunk 8.2.12.

I am trying to get a distinct count of incidents that have happened in each month, year to date. I'd like to compare that to the year prior. 

I feel like this should be pretty easy, but my results aren't showing the current year in comparison to the previous year.

This shows the current year data (2024)

(earliest=-1@y@y AND latest=now())
| eval date_month=strftime(_time, "%mon")
| eval date_year = strftime(_time, "%Y")
| timechart span=1mon dc(RMI_MastIncNumb) as "# of Incidents"

When I add | timewrap 1year series=exact time_format=%Y it ends up just showing me 2023

[bowesmana]

Your earliest= statement is wrong, it should be earliest=-1y@y

You have an extra @ sign (-1@y@y)