Comparing Stats Time Over Time

index=_internal earliest=-48h latest=-24h | bin _time span=10m | stats count by _time | eval window="yesterday" | append [ search index=_internal earliest=-24h | bin _time span=10m | stats count by _time| eval window="today" | eval _time=(_time-(60*60*24))] | timechart span=10m sum(count) by window

This search will lay a count of something (in this case, just a count) on a timechart, with a corresponding count on the same time frame axis. With this simple search, you can modify to view any variable over just about any time frame. Modify the “index” and “stats” command, as well as the eval command to slide time.

Share This: