I'm trying to get Thursday of this week compared with Thursday of last week and have the values overlay in a stack graph.
Using the following search, based off this link, I'm not able to get the data to overlap I can only get it working side by side.
source="Perfmon:CPU Load" counter="% Processor Time" host="SERVER01" earliest=-1d@d latest=-0d@d
| eval ReportKey="this week"
| append maxtime=600 [search source="Perfmon:CPU Load" counter="% Processor Time" host="SERVER01" earliest=-8d@d latest=-7d@d
| eval _time=_time+60*60*24*7
| eval ReportKey="last week"]
| timechart span=5m avg(Value) by ReportKey
What am I missing?
Splunk Version 4.3.3