Getting Data In

How to divide yesterdays data with today's data?


Hello Folks ,

Need help. Every day new file generates with a FileSizeBytes value, I need to compare the yesterday's FileSizeBytes value with today's FileSizeBytes value. and store the result value on a new field.

Ex:      _time                                                                        FileSizeBytes 

           2021-11-13 02:21:51.327                             116786105

           2021-11-12 02:15:18.357                              116757352

Job runs from Tue- Sat

Labels (6)
0 Karma

| sort 0 _time
| streamstats values(FileSizeBytes) as previousFileSizeBytes current=f window=1


@ITWhisperer  Appreciate your help sir.

I have added the below line for getting the exact result.

| eval result = fileSizeBytes-PerviousFileSizeBytes . Which stores the result in result filed. 

0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...