https://community.splunk.com/t5/Splunk-Search/compare-current-hour-and-previous-hour-value-in-search-and-find/m-p/487008#M193781 <P>my answer is ammended. I'm misunderstand.</P> Wed, 15 Jan 2020 09:23:33 GMT to4kawa 2020-01-15T09:23:33Z https://community.splunk.com/t5/Splunk-Search/compare-current-hour-and-previous-hour-value-in-search-and-find/m-p/487000#M193773 <P>I want to compare current top of an hour value with previous top of an hour value. For e.g. between 9 am to 10 am - get the value from exactly 10 am as curr_value and get the value from exactly 9 am as prev_value, find the difference and show the value. This will be applicable for next hour also :</P> <P>I am using below query to get the earliest and latest value of the hour, but not sure on whether the events are returning proper :</P> <PRE><CODE>index=dc sourcetype=total_energy earliest=-1h@h latest=@h | stats latest(value) as curr_value earliest(value) as hour_before by source,snmp_index </CODE></PRE> <P>Please help ?</P> Wed, 30 Sep 2020 03:43:18 GMT https://community.splunk.com/t5/Splunk-Search/compare-current-hour-and-previous-hour-value-in-search-and-find/m-p/487000#M193773 pgadhari 2020-09-30T03:43:18Z https://community.splunk.com/t5/Splunk-Search/compare-current-hour-and-previous-hour-value-in-search-and-find/m-p/487001#M193774 <P>UPDATE2:</P> <PRE><CODE>index=dc sourcetype=total_energy earliest=-1h@h latest=@h | stats last(_time) as curr_time last(value) as curr_value first(_time) as hour_beforetime first(value) as hour_before by source,snmp_index | fieldformat curr_time=strftime(curr_time,"%c") | fieldformat hour_beforetime=strftime(hour_beforetime,"%c") </CODE></PRE> <P>how about this?</P> Tue, 14 Jan 2020 09:46:04 GMT https://community.splunk.com/t5/Splunk-Search/compare-current-hour-and-previous-hour-value-in-search-and-find/m-p/487001#M193774 to4kawa 2020-01-14T09:46:04Z https://community.splunk.com/t5/Splunk-Search/compare-current-hour-and-previous-hour-value-in-search-and-find/m-p/487002#M193775 <P>latest and earliest will also do the same, but is it possible to check whether it is really taking the proper first and last value bu using _time ?</P> Tue, 14 Jan 2020 10:29:14 GMT https://community.splunk.com/t5/Splunk-Search/compare-current-hour-and-previous-hour-value-in-search-and-find/m-p/487002#M193775 pgadhari 2020-01-14T10:29:14Z https://community.splunk.com/t5/Splunk-Search/compare-current-hour-and-previous-hour-value-in-search-and-find/m-p/487003#M193776 <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8238iF87574EB0218943C/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 14 Jan 2020 10:31:49 GMT https://community.splunk.com/t5/Splunk-Search/compare-current-hour-and-previous-hour-value-in-search-and-find/m-p/487003#M193776 pgadhari 2020-01-14T10:31:49Z https://community.splunk.com/t5/Splunk-Search/compare-current-hour-and-previous-hour-value-in-search-and-find/m-p/487004#M193777 <P>in the above image, how do I verify whether curr_value is of 1 PM and hour_before is of 2 PM ?</P> <P>Query I am using is :</P> <PRE><CODE>index=dc sourcetype=total_energy earliest=-1h@h latest=@h | stats last(value) as curr_value first(value) as hour_before by source,snmp_index </CODE></PRE> Wed, 30 Sep 2020 03:43:25 GMT https://community.splunk.com/t5/Splunk-Search/compare-current-hour-and-previous-hour-value-in-search-and-find/m-p/487004#M193777 pgadhari 2020-09-30T03:43:25Z https://community.splunk.com/t5/Splunk-Search/compare-current-hour-and-previous-hour-value-in-search-and-find/m-p/487005#M193778 <P>@pgadhari<BR /> my answer is updated, please confirm.</P> Tue, 14 Jan 2020 10:43:17 GMT https://community.splunk.com/t5/Splunk-Search/compare-current-hour-and-previous-hour-value-in-search-and-find/m-p/487005#M193778 to4kawa 2020-01-14T10:43:17Z https://community.splunk.com/t5/Splunk-Search/compare-current-hour-and-previous-hour-value-in-search-and-find/m-p/487006#M193779 <P>actually, the value field is not the timestamp field. It is just, some energy value. I think you are taking it as "epoch" value ? its not that.</P> <P>What I want to know is - the latest (energy) value and earliest (energy) value, which I am getting in the value field is of the proper time of curr_hour and prev_hour ? How do I verify that ? Hope you got it ?</P> Wed, 30 Sep 2020 03:43:42 GMT https://community.splunk.com/t5/Splunk-Search/compare-current-hour-and-previous-hour-value-in-search-and-find/m-p/487006#M193779 pgadhari 2020-09-30T03:43:42Z https://community.splunk.com/t5/Splunk-Search/compare-current-hour-and-previous-hour-value-in-search-and-find/m-p/487007#M193780 <P>Hello,</P> <P>I thinks your request is good, to verify you can run this request:</P> <PRE><CODE>index=dc sourcetype=total_energy earliest=-1h@h latest=@h | sort - _time | table _time value source,snmp_index </CODE></PRE> <P>And:</P> <PRE><CODE>index=dc sourcetype=total_energy earliest=-1h@h latest=@h | sort _time | table _time value source,snmp_index </CODE></PRE> Wed, 15 Jan 2020 09:18:49 GMT https://community.splunk.com/t5/Splunk-Search/compare-current-hour-and-previous-hour-value-in-search-and-find/m-p/487007#M193780 TISKAR 2020-01-15T09:18:49Z https://community.splunk.com/t5/Splunk-Search/compare-current-hour-and-previous-hour-value-in-search-and-find/m-p/487008#M193781 <P>my answer is ammended. I'm misunderstand.</P> Wed, 15 Jan 2020 09:23:33 GMT https://community.splunk.com/t5/Splunk-Search/compare-current-hour-and-previous-hour-value-in-search-and-find/m-p/487008#M193781 to4kawa 2020-01-15T09:23:33Z https://community.splunk.com/t5/Splunk-Search/compare-current-hour-and-previous-hour-value-in-search-and-find/m-p/487009#M193782 <P>ok. I will check and revert. Thanks.</P> Thu, 16 Jan 2020 05:17:31 GMT https://community.splunk.com/t5/Splunk-Search/compare-current-hour-and-previous-hour-value-in-search-and-find/m-p/487009#M193782 pgadhari 2020-01-16T05:17:31Z