Wants to compare last 4 hours data with last 2 days data over the same time

[Sishad]

Hi Splunk experts,

I want to compare the response code of our API for last 4 hours with last 2 days data over the same time.
And if possible I would need results in a chart/table format where it shows the data as below.

<Reponse Codes | Last 4 Hours | Yesterday | Day before Yesterday>

As of now i am getting results in hours wise.
Can we achieve this one in Splunk ? Can you guys please guide me in the right direction to achieve this.

[Sishad]

Thanks @ITWhisperer for your suggestion.😊 

I was able to do produce the requested data via this command.

[ITWhisperer]

Start by changing the time period on your search to (earliest=now-4h latest=now) OR (earliest=-1d-4h latest=-1d) OR (earliest=-2d-4h latest=-2d)

[Sishad]

But I was looking to can show these 3 timeline values as a chart/table.
So that I can create a report on this and send out email to my team.
Can this be achieved ?

[ITWhisperer · Accepted solution]

Yes, the timewrap command can take the output from a timechart to create multiple lines over the 4 hour period