Two timecharts for different time frames (today/yesterday) on one graph

[dab55]

Hi all,

I'm trying to create a chart containing two timecharts for different time frames (e.g. today/yesterday). How can I achieve it?

Currently I'm getting it one after another on the same graph. I'd like basically to overlay one timechart on another one.

index=ddos device_event_class_id=Bandwidth earliest=-1d@d latest=-0d@d | rex field=msg "msg=.+raffic.+'(?<pg_name>[\w\s\-]+)'.+(?<bps>\d+\.\d+\s.+)\..+" | eval ReportKey="yersterday" | timechart span=3h count by pg_name | append [search index=ddos device_event_class_id=Bandwidth earliest=-2d@d latest=-1d@d | rex field=msg "msg=.+raffic.+'(?<pg_name>[\w\s\-]+)'.+(?<bps>\d+\.\d+\s.+)\..+" | eval ReportKey="beforeyesterday" | timechart span=3h count by pg_name ] | fillnull value=0 | eval mytime=strftime(_time, "%H:%M") | sort mytime

Thanks in advance.

[ITWhisperer · Accepted solution]

Try adding:

| timewrap d

[dab55]

@ITWhisperer @richgalloway 

Thanks a lot!

[richgalloway]

Check out the timewrap command.