how to compare successful logins in the host with yesterday's

[satyaallaparthi]

Hello,

I am getting successful logins from each server which is like 4000 per day from Each server. But some days that number is going high.
How can I compare successful logins with yesterday and how to get the difference between yesterday and today?

and create a notable event which is more than normal logins by comparing 2.

Any help would be appreciated!

Thanks,

[mayurr98 · Accepted solution]

Try this logic :

index=_internal earliest=-1d@d latest=now 
| timechart count span=1d 
| timewrap d 
| rename 1day_before as Yesterday latest_day as Today 
| eval diff=Yesterday-Today