I need to calculate the difference between a field in the most recent event with a given account_id and the latest event that is atleast a week before this one.
06/24/2018 02:45:57 PM
07/01/2018 03:45:57 PM
We want to see if this field changes over the span of a week. What would be the best way of doing this?
Your Base Search Here
| streamstats time_window=7d values(COMPARED_FIELD) dc(COMPARED_FIELD) num_values range(COMPARED_FIELD) BY AccountId
| where num_values>1