Compare two different values from two different periods

[exocore123]

I saw a few examples

https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-search-results-from-two-different-tim...

https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-time-same-time-frames-with-differen...

But these queries arent exact doing what I want to do. I basically want to do a 10min interval from now to 10 minutes ago. And compare it against the value from -24h and -24h (and 10 minutes before that) to do a comparison between the values. Whether it is in day to day trend for that 10min period

index=oms sourcetype="oms-dashboard" logType="transaction" stage="end" earliest=-24h latest=-1h
| eval period=if(_time>=relative_time(now(),"-23h"),"current","previous")  | chart count(request) over request by period  | eval difference=abs(previous-current)/previous*100 | table request difference previous current

Does anyone has an idea?

[bowesmana]

Why don't you just set your initial search to capture the two periods of data like this

(index=oms sourcetype="oms-dashboard" logType="transaction" stage="end" earliest=-1450m latest=-1440m) OR
(index=oms sourcetype="oms-dashboard" logType="transaction" stage="end" earliest=-10m latest=now)
| eval period=if(_time>=relative_time(now(),"-23h"),"current","previous")
| chart count(request) over request by period
| eval difference=abs(previous-current)/previous*100
| table request difference previous current

The rest of your search is fine.

[exocore123]

Actually I think I solved it

index=oms sourcetype="oms-prod" logType="transaction" stage="end" earliest=-2h latest=-1h | stats count AS previous by request | appendcols [search index=ecp-ord-oms-ext sourcetype="ecp-ord-owls-prod-*" logType="transaction" stage="end" earliest=-1h latest=now | stats count AS current by request] | eval difference=abs(previous-current)/previous*100

[bowesmana]

@exocore123 

Using appendcols will not be as fast as using a single search and also you have to be totally sure that the requests from the previous time period all exist in the current time period otherwise your appendcols will generate the counts out of sync, so the rows won't match.

(index=oms sourcetype="oms-prod" logType="transaction" stage="end" earliest=-2h latest=-1h) OR
(index=ecp-ord-oms-ext sourcetype="ecp-ord-owls-prod-*" logType="transaction" stage="end" earliest=-1h latest=now)

 Use this as your single search and then do your previous logic. 

[exocore123]

Good point - I dont know why I didnt think of that - I'll try this