Hello all, New splunker here, so forgive me if this is totally way wrong to do it. I was asked to make a comparison dashboard for application performance before the monthly patch and after. I was able to do so with the following code:         index=erp sourcetype=erp_heartbeat tenant=AX2 earliest=-31d@month latest=-1d@month | eval custate="Post-Update" | append [ search index=erp sourcetype=erp_heartbeat tenant=AX2 earliest=-61d@month latest=-30d@month | eval custate="Pre-Update" ] | chart avg(duration) by trans_name, custate       In a recent touchpoint, it was requested that users be able to change the dates to look at prior months' numbers. I can't figure out how to accomplish this as I'm using specific earliest and latest time modifiers   , so any help would be tremendously appreciated.  Thank you all, as I've gotten this far with your community.  ... View more