I want to create a time chart (line) based on the count of events for the past 24 hours, and one week earlier same day and same time period
I can create a time chart using the following:
index=myindex | timechart count
I know I can the previous week by using the following:
index=myindex earliest-7d@h latest -6d@h
How do I create a line chart using the values for the past 24 hours and the values from the previous week?
What will the search be?
There is a very similar discussion at this thread:
Comparing today's data with last week's data
The technique that fpigeon uses is fine - but he ran into problems because of the volume of data. I thought it might be easier to take a look there than to run through it here.
But if you still have issues, can you give more details on the searches that you want to run?