Pardon the poor search..I'm still a noob with this:
index=anyindex earliest=-60m latest=now | eval label= "current" | timechart span=5m count by label| appendcols [ search index=anyindex | eval earliest_time=relative_time(now(),"-60m-24h") | eval latest_time=if($range.latest$=="now",relative_time(now(),"-24h"),relative_time(now(),"$range.latest$-24h")) | where _time>earliest_time and _time<=latest_time | eval label= "day ago" | timechart span=5m count by label]
... View more