Getting Data In

How to divide yesterdays data with today's data?


Hello Folks ,

Need help. Every day new file generates with a FileSizeBytes value, I need to compare the yesterday's FileSizeBytes value with today's FileSizeBytes value. and store the result value on a new field.

Ex:      _time                                                                        FileSizeBytes 

           2021-11-13 02:21:51.327                             116786105

           2021-11-12 02:15:18.357                              116757352

Job runs from Tue- Sat

Labels (6)
0 Karma

| sort 0 _time
| streamstats values(FileSizeBytes) as previousFileSizeBytes current=f window=1


@ITWhisperer  Appreciate your help sir.

I have added the below line for getting the exact result.

| eval result = fileSizeBytes-PerviousFileSizeBytes . Which stores the result in result filed. 

0 Karma
Get Updates on the Splunk Community!

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

The Great Resilience Quest: 9th Leaderboard Update

The ninth leaderboard update (11.9-11.22) for The Great Resilience Quest is out >> Kudos to all the ...