Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Compare two timerange in one report

$
0
0

Hello,

I did a chart where compare two timeranges. This is my search:

source="tcp:5543" Service_Type="*" earliest=-0d@d latest=now | multikv | eval ReportKey="today" | append [search source="tcp:5543" Service_Type="*" earliest=-1d@d latest=-0d@d| multikv | eval ReportKey="yesterday" | eval _time=_time+86400] | timechart span=5m count(Service_Type) as "Number of Services"  by ReportKey

But I have the following messages when I launched it :

[subsearch]: Your timerange was substituted based on your search string
Your timerange was substituted based on your search string

But I don't understand where is the problem.

Thx by advance.


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>