Getting Data In

How to divide yesterdays data with today's data?


Hello Folks ,

Need help. Every day new file generates with a FileSizeBytes value, I need to compare the yesterday's FileSizeBytes value with today's FileSizeBytes value. and store the result value on a new field.

Ex:      _time                                                                        FileSizeBytes 

           2021-11-13 02:21:51.327                             116786105

           2021-11-12 02:15:18.357                              116757352

Job runs from Tue- Sat

Labels (6)
0 Karma

| sort 0 _time
| streamstats values(FileSizeBytes) as previousFileSizeBytes current=f window=1


@ITWhisperer  Appreciate your help sir.

I have added the below line for getting the exact result.

| eval result = fileSizeBytes-PerviousFileSizeBytes . Which stores the result in result filed. 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Starting With Observability: OpenTelemetry Best Practices

Tech Talk Starting With Observability: OpenTelemetry Best Practices Tuesday, October 17, 2023   |  11AM PST / ...