Reporting on Duplicates

[mphillips_18]

Hello,

So every 24 hours we run daily evaluations on computers that create numerical ratings. Our daily reports display Time(of scan), ComputerID, rating value. After 24 hours, all nodes are scanned again. Some will (hopefully) have a lower numerical rating value. We would like to run a separate report showing the change in value of the numerical rating for each compuert that actually changed over the 24 hour period.

ComputerID=5 character alpha numeric
Rating value=0-100

The following query works for single instances of evaluation.
index=main sourcetype=scan host=scanner ComputerID==1234R | stats range(numerical_rating) AS "Daily Change",values AS Computers | table Computers,"Daily Changes"

Unfortunately we can not get this to evaluate properly against 200 computerIDs at one time. Is there a way to separate out the duplicate computerIDs with associated unique numerical_ratings and then get the difference of the numerical_rating reported with the associated computerID?
DOH!

Thanks!

[martin_mueller]

Based on above generated data, you can do this:

index=main sourcetype=scan host=scanner | sort + _time
| streamstats window=1 global=f current=f last(Rating) as last_rating by ComputerID
| eval "Rating Change" = Rating - last_rating | table _time ComputerID Rating "Rating Change"

[mphillips_18]

BINGO! I missed one of the fields.

Thank you

[martin_mueller]

Make sure your field names match. For example, you've said ComputerID in the question but computerID in this comment.

[mphillips_18]

Thanks...the query returns data except for the "Rating Change" value. None of the duplicate computerIDs display a value for Rating - last_rating

[martin_mueller]

Does this generate a data set matching your events?

| gentimes start=-10 | eval _time = endtime | fields _time | eval ComputerID = "id1 id2 id3" | makemv ComputerID | mvexpand ComputerID | eval Rating = random()%101