Splunk Search

Two timecharts for different time frames (today/yesterday) on one graph

dab55
Engager

Hi all,

I'm trying to create a chart containing two timecharts for different time frames (e.g. today/yesterday). How can I achieve it?
Currently I'm getting it one after another on the same graph. I'd like basically to overlay one timechart on another one.
 
index=ddos device_event_class_id=Bandwidth earliest=-1d@d latest=-0d@d | rex field=msg "msg=.+raffic.+'(?<pg_name>[\w\s\-]+)'.+(?<bps>\d+\.\d+\s.+)\..+" | eval ReportKey="yersterday" | timechart span=3h count by pg_name | append [search index=ddos device_event_class_id=Bandwidth earliest=-2d@d latest=-1d@d | rex field=msg "msg=.+raffic.+'(?<pg_name>[\w\s\-]+)'.+(?<bps>\d+\.\d+\s.+)\..+" | eval ReportKey="beforeyesterday" | timechart span=3h count by pg_name ] | fillnull value=0 | eval mytime=strftime(_time, "%H:%M") | sort mytime

2021-04-15_13-19-23.png

 

Thanks in advance.

Labels (2)
0 Karma
1 Solution

ITWhisperer
Ultra Champion

Try adding:

| timewrap d

View solution in original post

ITWhisperer
Ultra Champion

Try adding:

| timewrap d

View solution in original post

dab55
Engager

@ITWhisperer @richgalloway 

Thanks a lot!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Check out the timewrap command.

---
If this reply helps you, an upvote would be appreciated.
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!