append comparison to 1 week earlier with timechart by

[bwscot]

I have the following search which works nicely and shows me total sales over the past 24 hours compared to total sales the same day 1 week ago:

earliest=-1d@h latest=now eventtype=SALE | timechart span=15m count | eval sales="Past 24 Hours" | append [search earliest=-7d@h latest=-6d eventtype=SALE | timechart span=15m count | eval sales="Same Day Last Week" | eval _time =_time+86400*6] | timechart span=15m sum(count) AS count BY sales

I would like to do the same thing but timechart by a field (venue) so the result in a line chart would have 4 lines (assuming 2 venues). venue A, venue B, and total (venue a+b) (all for past 24 hours) and a fourth line with venue a+b the same time period a week ago.

The following search will show me the first three lines but I can not figure out how to include a fourth line showing the total from a week ago:

earliest=-1d@h latest=now eventtype=SALE AND venue="A" OR "B" | timechart span=15m count by venue | addtotals

Thanks in advance for your help

[eelisio2]

This looks like it will give you what you want.

earliest=-7d@d latest=-6d@d eventtype=SALE AND venue="A" OR venue="B" | eval label="Total Same Day Last Week" | eval _time =_time+60*60*24*7 | append [search earliest=-0d@d eventtype=SALE AND venue="A" OR venue="B" | eval label="Total Today"] | append [search earliest=-0d@d eventtype=SALE AND venue="A" OR venue="B" | eval label=venue] | timechart span=15m count by label 

[bwscot]

Thanks for helping. This did not get me what I was looking for, but I was able to get it with appendcols:

earliest=-1d@h latest=now eventtype=SALE AND venue="A" OR "B" | timechart span=30m count | eval label="Total Today" | append [search earliest=-7d@h latest=-6d eventtype=SALE AND AND venue="A" OR "B" " | timechart span=30m count | eval label="Total Same Day Last Week" | eval _time =_time+86400*6] | timechart span=30m sum(count) AS count BY label | appendcols [search earliest=-1d@h latest=now eventtype=SALE AND AND venue="A" OR "B" | timechart span=30m count by venue]