Here is what I did... I wanted to compare the last 7 running days with the previous 7 running days and overlay them on the same graph.
I wrote the following queries and strung them together to make sure they worked:
index=sde sourcetype=sde_tickets State=C earliest=-13d@d latest=-7d@d CloseGroup="IS DESKTOP" | dedup Incident | timechart span=1d count(Incident) as Previous | eval Day=strftime(_time,"%a") | table Day,Previous | join Day type=outer [search index=sde sourcetype=sde_tickets State=C earliest=-6d@d CloseGroup="IS DESKTOP" | dedup Incident | timechart span=1d count(Incident) as Current | eval Day=strftime(_time,"%a") | table Day,Current]
I tried saving them and then joining using savedsearch but it didn't work. I am sure I was missing something and that it would with the correct syntax.
The above query lets me display the two periods, each as series and they graph nicely together. If you had overlapping buckets, this wouldn't work. For example, if I had wanted to do the last 30 days I would have had to come up with some other value for my X axis instead of the name of the day of the week.
My preference is to not do it this way, but to put two charts on the dashboard, one to show current and one to show previous, but it was how others wanted it.
... View more
