I have the following search which works nicely and shows me total sales over the past 24 hours compared to total sales the same day 1 week ago:
earliest=-1d@h latest=now eventtype=SALE | timechart span=15m count | eval sales="Past 24 Hours" | append [search earliest=-7d@h latest=-6d eventtype=SALE | timechart span=15m count | eval sales="Same Day Last Week" | eval _time =_time+86400*6] | timechart span=15m sum(count) AS count BY sales
I would like to do the same thing but timechart by a field (venue) so the result in a line chart would have 4 lines (assuming 2 venues). venue A, venue B, and total (venue a+b) (all for past 24 hours) and a fourth line with venue a+b the same time period a week ago.
The following search will show me the first three lines but I can not figure out how to include a fourth line showing the total from a week ago:
earliest=-1d@h latest=now eventtype=SALE AND venue="A" OR "B" | timechart span=15m count by venue | addtotals
Thanks in advance for your help
... View more