https://community.splunk.com/t5/Splunk-Search/How-to-compare-same-field-values-at-different-times/m-p/208102#M60668 <P>Can you give us sample logs? </P> Tue, 02 Aug 2016 17:37:11 GMT Masa 2016-08-02T17:37:11Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-same-field-values-at-different-times/m-p/208100#M60666 <P>How can I do a comparison with values from same field at different times? The logs belongs to the same index/sourcetype. There's a field called <STRONG>lagtime</STRONG> which basically denotes how long it took to complete a process/action. Goal is to compare the lagtime at current time with lagtime in past 12 hours and display the results only if there is no match. </P> Mon, 01 Aug 2016 17:05:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-same-field-values-at-different-times/m-p/208100#M60666 muralianup 2016-08-01T17:05:32Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-same-field-values-at-different-times/m-p/208101#M60667 <P>Try this</P> <PRE><CODE>... earliest=-12h@h | eventstats latest(lagtime) as currentlagtime | where currentlagtime!=lagtime | ... </CODE></PRE> Mon, 01 Aug 2016 17:25:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-same-field-values-at-different-times/m-p/208101#M60667 sundareshr 2016-08-01T17:25:37Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-same-field-values-at-different-times/m-p/208102#M60668 <P>Can you give us sample logs? </P> Tue, 02 Aug 2016 17:37:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-same-field-values-at-different-times/m-p/208102#M60668 Masa 2016-08-02T17:37:11Z