@mbond81, I have converted my comment to answer. Please accept to mark this as answered! ... View more

beauty command, that I didn't even know existed! thanks! ... View more

I may have gotten this to work using... |sort + _time| delta ErrCount as difference | timechart span=5m per_second(difference) by xyz useother=f usenull=f I'll follow up later if this has answered my own question. ... View more

I'm trying to do a similar thing comparing current day values to yesterdays, as an overlay for visualization. Here's what I found (but you can modify the earliest/latest times and the "new time" to reflect whatever timeframe you wish. (found here http://blogs.splunk.com/2012/02/19/compare-two-time-ranges-in-one-report/) index=whatever sourcetype=whatever "Packetspersecond" sceInfoId=17 OR sceInfoId=18 earliest=-0d@d latest=now | eval ShaperData="today" | append [search index=nethlth sourcetype="nethlth_SceProcessorData" Packetspersecond sceInfoId=17 OR sceInfoId=18 earliest=-1d@d latest=-0d@d | eval ShaperData="yesterday" | eval new_time=_time+86400] | eval _time=if(isnotnull(new_time),new_time,_time) | timechart median(packetsPerSecond) span=15m by ShaperData ... View more

I hate it when simple things get the best of me. (Happens more than I like to admit) Thanks for the help, fellas! The fix: I was missing the pipe in front of the 'where'. It works as | stats count as logins by | where logins > 250 So easy a caveman could do it. . . lucky for me! ... View more