https://community.splunk.com/t5/Splunk-Enterprise-Security/can-some-explain-this-search-please/m-p/476955#M7541 <P>my search |eval _time= strftime(_time, "%Y-%m-%d")|stats latest(AssetRiskScore) as score by _time AssetNames | sort 0 - _time<BR /> | dedup 2 AssetNames | reverse<BR /> | streamstats current=f last(score) AS prev_score BY AssetNames<BR /> | eval change = score - prev_score</P> Wed, 30 Sep 2020 05:02:09 GMT vikram1583 2020-09-30T05:02:09Z https://community.splunk.com/t5/Splunk-Enterprise-Security/can-some-explain-this-search-please/m-p/476955#M7541 <P>my search |eval _time= strftime(_time, "%Y-%m-%d")|stats latest(AssetRiskScore) as score by _time AssetNames | sort 0 - _time<BR /> | dedup 2 AssetNames | reverse<BR /> | streamstats current=f last(score) AS prev_score BY AssetNames<BR /> | eval change = score - prev_score</P> Wed, 30 Sep 2020 05:02:09 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/can-some-explain-this-search-please/m-p/476955#M7541 vikram1583 2020-09-30T05:02:09Z https://community.splunk.com/t5/Splunk-Enterprise-Security/can-some-explain-this-search-please/m-p/476956#M7542 <PRE><CODE>|eval _time= strftime(_time, "%Y-%m-%d") |stats latest(AssetRiskScore) as score by _time AssetNames | sort 0 - _time | dedup 2 AssetNames | reverse | streamstats current=f last(score) AS prev_score BY AssetNames | eval change = score - prev_score </CODE></PRE> <UL> <LI> chang epoch time to text like <CODE>2020-04-15</CODE></LI> <LI>aggregate by <CODE>_time</CODE> and <CODE>AssetNames</CODE> this display latest <CODE>AssetRiskScore</CODE> values as <CODE>score</CODE></LI> <LI>sort <CODE>_time</CODE> ascending</LI> <LI>keep only first two <CODE>AssetNames</CODE></LI> <LI>sort <CODE>_time</CODE> descending</LI> <LI>by each AssetNames, display just before <CODE>score</CODE> value(like <CODE>autoregress</CODE>)</LI> <LI>calculate <CODE>change</CODE></LI> </UL> Thu, 16 Apr 2020 21:38:24 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/can-some-explain-this-search-please/m-p/476956#M7542 to4kawa 2020-04-16T21:38:24Z https://community.splunk.com/t5/Splunk-Enterprise-Security/can-some-explain-this-search-please/m-p/476957#M7543 <P>If I make it:</P> <PRE><CODE> |eval _time= strftime(_time, "%Y-%m-%d") |stats range(AssetRiskScore) as change min(AssetRiskScore) as prev_score max(AssetRiskScore) as score by _time AssetNames </CODE></PRE> <P>This is enough. </P> Fri, 17 Apr 2020 20:11:18 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/can-some-explain-this-search-please/m-p/476957#M7543 to4kawa 2020-04-17T20:11:18Z