Splunk Search

Compare stats of current day with previous day


Hi all!
I am currently getting stats of current day as followed
Port Count
25 25
443 75
53 990

I wanted a table like this

Port Count(Previous Day) Count(Current Day)
25 25 30
443 75 40
53 990 50

My query is like this

Index=* | stats count by port

Please confirm is it possible
Please help!

0 Karma

Path Finder

Have you tried to use the | appendcols function? or Just append ?

Your search here 
| appendcols [ | search your search here earliest=-2d latest=-1d 
| stats count as yesterday by Port ]
| stats count as today, sum(yesterday) as yesterday by Port


Your search
| eval date="newer"
| append  [ | search <your search> " earliest=-2d latest=-1d 
    |  eval date="older" 
    |  stats count by Port date ]
| stats count by Port date
0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...