https://community.splunk.com/t5/Splunk-Search/How-do-I-find-the-delta-between-sum-of-values-for-two-days-with/m-p/270332#M175777 <P>the date_* fields are not considered authoritative from an accuracy standpoint, and your query will only work as long as you have queries less than one week (non-overlapping days of the week).</P> Tue, 31 Jan 2017 16:04:33 GMT rjthibod 2017-01-31T16:04:33Z https://community.splunk.com/t5/Splunk-Search/How-do-I-find-the-delta-between-sum-of-values-for-two-days-with/m-p/270329#M175774 <P>index=_internal type=usage idx=wineventlog | bucket span=1d _time | stats sum(b) as sum by h,_time</P> <P>The above query gives the sum for "b" values over a period of one day. If I run the query for time period of two days I get two sums for "h". Difference between these two sums need to be found.</P> Tue, 29 Sep 2020 12:40:36 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-find-the-delta-between-sum-of-values-for-two-days-with/m-p/270329#M175774 rajapr15 2020-09-29T12:40:36Z https://community.splunk.com/t5/Splunk-Search/How-do-I-find-the-delta-between-sum-of-values-for-two-days-with/m-p/270330#M175775 <P>Look at the last answer in this post</P> <P><A href="https://answers.splunk.com/answers/47037/delta-then-sum-then-graph-from-multiple-hosts.html">https://answers.splunk.com/answers/47037/delta-then-sum-then-graph-from-multiple-hosts.html</A></P> <PRE><CODE>index=_internal type=usage idx=wineventlog | bucket span=1d _time | stats sum(b) as b by h,_time | streamstats current=t global=f window=2 latest(b) as curr earliest(b) as next by h | eval delta=next-curr | timechart span=1d sum(delta) as delta by h </CODE></PRE> Tue, 31 Jan 2017 13:41:41 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-find-the-delta-between-sum-of-values-for-two-days-with/m-p/270330#M175775 rjthibod 2017-01-31T13:41:41Z https://community.splunk.com/t5/Splunk-Search/How-do-I-find-the-delta-between-sum-of-values-for-two-days-with/m-p/270331#M175776 <P>Thanks!</P> <P>I found an alternative which worked for me- </P> <P>index=_internal type=usage idx=wineventlog | chart sum(b) by h date_wday | eval diff=sunday-tuesday | eval diff=abs(diff) | sort -diff</P> Tue, 29 Sep 2020 12:40:43 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-find-the-delta-between-sum-of-values-for-two-days-with/m-p/270331#M175776 rajapr15 2020-09-29T12:40:43Z https://community.splunk.com/t5/Splunk-Search/How-do-I-find-the-delta-between-sum-of-values-for-two-days-with/m-p/270332#M175777 <P>the date_* fields are not considered authoritative from an accuracy standpoint, and your query will only work as long as you have queries less than one week (non-overlapping days of the week).</P> Tue, 31 Jan 2017 16:04:33 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-find-the-delta-between-sum-of-values-for-two-days-with/m-p/270332#M175777 rjthibod 2017-01-31T16:04:33Z