https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-value-between-search-strings/m-p/348166#M174875 <P>How about this?</P> <PRE><CODE>index_earliest=-1d@d index=index source="PerfmonMk:Free Disk Space" "%_Free_Space"="*" E | eval volume=Free_Megabytes/1024 | bin _time bins=30 | stats avg(volume) as daily_Kilobytes by _time | append [ search index_earliest=-1mon@mon index_latest=@m index=index source="PerfmonMk:Free Disk Space" "%_Free_Space"="*" E | bin _time span=1d | eval volume=Free_Megabytes/1024 | stats avg(volume) as monthly_Kilobytes by _time ] | timechart values(daily_Kilobytes) values(monthly_Kilobytes) </CODE></PRE> Mon, 24 Apr 2017 14:36:07 GMT jkat54 2017-04-24T14:36:07Z https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-value-between-search-strings/m-p/348164#M174873 <P>Hi,</P> <P>I am using a single search string with two different time rage to find the disk space.</P> <P>Search string : index= source="PerfmonMk:Free Disk Space" "%_Free_Space"="*" E | eval volume=Free_Megabytes/1024 | chart avg(volume)<BR /> 1. Time range of last 24 hours <BR /> 2. Time range of Previous month</P> <P>By using this I am getting two different charts as output.</P> <P>I need the string to find the difference between these two charts. or a single string to define the disk space of current day and 30 days before (previous month)</P> <P>Thanks,</P> Tue, 29 Sep 2020 13:49:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-value-between-search-strings/m-p/348164#M174873 Gowtham0809 2020-09-29T13:49:16Z https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-value-between-search-strings/m-p/348165#M174874 <P>how about using timechart command? set the timepicker to last 30 days</P> <PRE><CODE> index= source="PerfmonMk:Free Disk Space" "%_Free_Space"="*" E | eval volume=Free_Megabytes/1024 | timechart span=24h avg(volume) </CODE></PRE> <P>hope it helps</P> Mon, 24 Apr 2017 14:06:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-value-between-search-strings/m-p/348165#M174874 adonio 2017-04-24T14:06:32Z https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-value-between-search-strings/m-p/348166#M174875 <P>How about this?</P> <PRE><CODE>index_earliest=-1d@d index=index source="PerfmonMk:Free Disk Space" "%_Free_Space"="*" E | eval volume=Free_Megabytes/1024 | bin _time bins=30 | stats avg(volume) as daily_Kilobytes by _time | append [ search index_earliest=-1mon@mon index_latest=@m index=index source="PerfmonMk:Free Disk Space" "%_Free_Space"="*" E | bin _time span=1d | eval volume=Free_Megabytes/1024 | stats avg(volume) as monthly_Kilobytes by _time ] | timechart values(daily_Kilobytes) values(monthly_Kilobytes) </CODE></PRE> Mon, 24 Apr 2017 14:36:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-value-between-search-strings/m-p/348166#M174875 jkat54 2017-04-24T14:36:07Z https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-value-between-search-strings/m-p/348167#M174876 <P>@jkat54 - <CODE>m</CODE> is minute. Probably need to use <CODE>-30d@d</CODE>.</P> Mon, 24 Apr 2017 16:58:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-value-between-search-strings/m-p/348167#M174876 DalJeanis 2017-04-24T16:58:43Z https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-value-between-search-strings/m-p/348168#M174877 <P>i always do that, thanks... updated to mon for month</P> Mon, 24 Apr 2017 18:17:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-value-between-search-strings/m-p/348168#M174877 jkat54 2017-04-24T18:17:44Z https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-value-between-search-strings/m-p/348169#M174878 <P>Thank you and it worked</P> Tue, 25 Apr 2017 05:23:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-value-between-search-strings/m-p/348169#M174878 Gowtham0809 2017-04-25T05:23:03Z https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-value-between-search-strings/m-p/348170#M174879 <P>Thank you and it worked</P> Tue, 25 Apr 2017 05:23:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-difference-in-value-between-search-strings/m-p/348170#M174879 Gowtham0809 2017-04-25T05:23:15Z