I have a search to graph the last 30 minutes in 5 minute intervals:
index=web_summary report="volumebyminuteweb" earliest=-30m@m latest=now | bucket _time span=5m|stats count by _time |timechart span=5m sum(count)
I would like to also graph the same time period for the previous 7, 14, 21, and 28 days on the same graph.
How would I modify the query to include the additional time periods?
Thanks in advance for your assistance.
Appendcols is what you want. You don't need the bucket and stats commands, just timechart:
index=web_summary report="volumebyminuteweb" earliest=-30m@m latest=@m |timechart span=5m count as Today |
appendcols [
search index=web_summary report="volumebyminuteweb" earliest=-30m@m-1w latest=@m-1w |timechart span=5m count as "1 week ago" ] |
appendcols [
search index=web_summary report="volumebyminuteweb" earliest=-30m@m-2w latest=@m-2w |timechart span=5m count as "2 weeks ago" ] |
appendcols [
search index=web_summary report="volumebyminuteweb" earliest=-30m@m-3w latest=@m-3w |timechart span=5m count as "3 weeks ago" ]
Appendcols is what you want. You don't need the bucket and stats commands, just timechart:
index=web_summary report="volumebyminuteweb" earliest=-30m@m latest=@m |timechart span=5m count as Today |
appendcols [
search index=web_summary report="volumebyminuteweb" earliest=-30m@m-1w latest=@m-1w |timechart span=5m count as "1 week ago" ] |
appendcols [
search index=web_summary report="volumebyminuteweb" earliest=-30m@m-2w latest=@m-2w |timechart span=5m count as "2 weeks ago" ] |
appendcols [
search index=web_summary report="volumebyminuteweb" earliest=-30m@m-3w latest=@m-3w |timechart span=5m count as "3 weeks ago" ]