https://community.splunk.com/t5/Splunk-Search/Join-two-statistics-tables-without-subsearch/m-p/550547#M156233 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp; Thank you!</P> Wed, 05 May 2021 15:37:02 GMT sbarinov 2021-05-05T15:37:02Z https://community.splunk.com/t5/Splunk-Search/Join-two-statistics-tables-without-subsearch/m-p/550541#M156228 <P>Hi,</P><P>&nbsp;</P><P>I am trying to compare event type count statistics for 2 days using the following search:</P><LI-CODE lang="markup">earliest=-48h latest=-24h | stats count as count1 by eventtype | table eventtype, count1 | join eventtype [search earliest=-24h latest=now() | stats count as count2 by eventtype | table eventtype, count2] | eval diff=(count2-count1) | table eventtype, diff | sort diff</LI-CODE><P>Is there any option to do this without using subsearch and join?</P><P>&nbsp;</P><P>Thanks.</P> Wed, 05 May 2021 15:03:49 GMT https://community.splunk.com/t5/Splunk-Search/Join-two-statistics-tables-without-subsearch/m-p/550541#M156228 sbarinov 2021-05-05T15:03:49Z https://community.splunk.com/t5/Splunk-Search/Join-two-statistics-tables-without-subsearch/m-p/550542#M156229 <LI-CODE lang="markup">earliest=-48h latest=now() | eval period=floor((now()-_time)/(24*60*60)) | stats count(eval(period=1)) as count1 count(eval(period=0)) as count2 by eventtype | eval diff=count2-count1 | table eventtype diff | sort diff</LI-CODE> Wed, 05 May 2021 15:21:03 GMT https://community.splunk.com/t5/Splunk-Search/Join-two-statistics-tables-without-subsearch/m-p/550542#M156229 ITWhisperer 2021-05-05T15:21:03Z https://community.splunk.com/t5/Splunk-Search/Join-two-statistics-tables-without-subsearch/m-p/550547#M156233 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp; Thank you!</P> Wed, 05 May 2021 15:37:02 GMT https://community.splunk.com/t5/Splunk-Search/Join-two-statistics-tables-without-subsearch/m-p/550547#M156233 sbarinov 2021-05-05T15:37:02Z