Getting Data In

How to divide yesterdays data with today's data?

yesh_9
Engager

Hello Folks ,

Need help. Every day new file generates with a FileSizeBytes value, I need to compare the yesterday's FileSizeBytes value with today's FileSizeBytes value. and store the result value on a new field.

Ex:      _time                                                                        FileSizeBytes 

           2021-11-13 02:21:51.327                             116786105

           2021-11-12 02:15:18.357                              116757352

Job runs from Tue- Sat

Labels (5)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| sort 0 _time
| streamstats values(FileSizeBytes) as previousFileSizeBytes current=f window=1

yesh_9
Engager

@ITWhisperer  Appreciate your help sir.

I have added the below line for getting the exact result.

| eval result = fileSizeBytes-PerviousFileSizeBytes . Which stores the result in result filed. 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...