using this articles advice (http://blogs.splunk.com/2012/02/19/compare-two-time-ranges-in-one-report/)
i am trying to compare year over year using the following search
index="stacks" earliest=-2mon@mon latest=-1mon@mon| multikv| eval ReportKey="thisYear"| append [search index="stacks" earliest=-14mon@mon latest=-13mon@mon| multikv| eval ReportKey="lastYear"]| timechart distinct_count(Check_Number) AS Check_Count, sum(Amount) AS "Net_Sales" by ReportKey
this generates the side by side data fine. when I add the eval modifier (eval
index="stacks" earliest=-2mon@mon latest=-1mon@mon| multikv| eval ReportKey="thisYear"| append [search index="stacks" earliest=-14mon@mon latest=-13mon@mon| multikv| eval ReportKey="lastYear" | eval _time=_time+60*60*24*365]| timechart distinct_count(Check_Number) AS Check_Count, sum(Amount) AS "Net_Sales" by ReportKey
The previous years data craps out.
Any idea what i am doing wrong?
It might be easier to use this app by David Carasso, Timewrap.
thank for responding. have you used it? i have tried using the timewrap y command and it doesnt work for me. only get the current year returned.