Hi.
I have a query that makes the difference of a query comparing today with last week.
I would like to generate a graph of percentage difference between the two, could someone help me?
My chart generates a timeline with events, however I would like a percentage chart.
earliest=-1w-12h latest=-1w index="raw_teste" (host=host1OR host=host2) "Retrieving message #"
| bucket _time span=20m | eval time=strftime(_time, "%H:%M") | chart count as "SemanaPassada" by time
| appendcols [search earliest=-12h latest=-5s index="raw_teste" (host=host1OR host=host2) "Retrieving message #"
| bucket _time span=20m | eval time=strftime(_time, "%H:%M") | chart count as "Hoje" by time]
↧