Okay, try this
sourcetype=yoursourcetype |
eval weekAgo = relative_time(now(), "-6d\@d") |
eval today = relative_time(now(), "\@d") |
eval ReportKey = "omit" |
eval ReportKey = case(_time < weekAgo,"Last Week", _time > today,"Today") |
where ReportKey != "omit" |
eval _time = if(ReportKey=="Last Week", _time+(60*60*24*7), _time) |
timechart fixedrange=f count by ReportKey
If that doesn't work for you, you should probably open another Question on the forum and include some additional details!
... View more