event count comparison with today vs yesterday vs last week vs prior week

[john_q]

Hi,
I have two strings like "opend" and "exited" in the events. So i need to count how many opened and exited today and that should be comparing today with yesterday vs last week vs prior week in the the form of line chart. legends should be like -Today-opened, -Today-exited,Yesterday-opened,Yesterday-exited and last week and prior week as well. Can you please help me.

[sandeepmakkena]

| multisearch 
     [ search index=****  "opend" earliest=-2w@w1 latest=-w@w1
     | eval what="prior week-opened"] 
     [search index=****  "exited" earliest=-2w@w1 latest=-w@w1
     | eval what="prior week-exited" ]
 [ search index=****  "opend" earliest=-w@w1 latest=@w1
     | eval what="prior week-opened"] 
     [search index=****  "exited" earliest=-w@w1 latest=@w1
     | eval what="last week-exited" ]
 [ search index=****  "opend" earliest=-1d@d latest=@d
     | eval what="last Yesterday-opened"] 
     [search index=****  "exited" earliest=-1d@d latest=@d
     | eval what="prior Yesterday-exited" ]
 [ search index=****  "opend" earliest=@d latest=+d@d
     | eval what="-Today-opened"] 
     [search index=****  "exited" earliest=@d latest=+d@d
     | eval what="-Today-exited" ]
 | chart count by date_hour what

check this.

[pramit46]

Have you tried timewrap command?

[john_q]

comparing the count using line chart time span=h??

[yannK]

look at previous similar questions
https://answers.splunk.com/answers/663294/timewrap-compare-last-24-hours-to-the-same-day-ove.html