Hello Folks ,
Need help. Every day new file generates with a FileSizeBytes value, I need to compare the yesterday's FileSizeBytes value with today's FileSizeBytes value. and store the result value on a new field.
Ex: _time FileSizeBytes
2021-11-13 02:21:51.327 116786105
2021-11-12 02:15:18.357 116757352
Job runs from Tue- Sat
| sort 0 _time
| streamstats values(FileSizeBytes) as previousFileSizeBytes current=f window=1
@ITWhisperer Appreciate your help sir.
I have added the below line for getting the exact result.
| eval result = fileSizeBytes-PerviousFileSizeBytes . Which stores the result in result filed.