Alerting

How create an alert to compare yesterday and today and show the difference for a value?

vrmandadi
Builder

I am trying to create an alert which will compare yesterday and today for a particular field and show what is the difference.

 

I want to count the total for field called "id" for today and compare the count with yesterday and show the count difference and the id's which are different .

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

See if this helps at all.

index=foo earliest=-1d@d latest=@d
| stats count as yesterday by id
| append [ search index=foo earliest=@d latest=now | stats count as today by id ]
| stats values(*) as * by id
| eval diff = today - yesterday
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

See if this helps at all.

index=foo earliest=-1d@d latest=@d
| stats count as yesterday by id
| append [ search index=foo earliest=@d latest=now | stats count as today by id ]
| stats values(*) as * by id
| eval diff = today - yesterday
---
If this reply helps you, an upvote would be appreciated.
0 Karma

vrmandadi
Builder

Thank You

0 Karma