Splunk Search

Comparing results from two searches

dcparker
Path Finder

Hello,

I am trying to compare the standard deviation from the last 24 hours to the standard deviation of the last 3 hours. I have my search, which is basically this:

earliest = -24h@h latest = @h | timechart span=1h count | stats stdev(count) as test | append [ search earliest = -3h@h latest = @h | timechart span=1h count | stats stdev(count) as testsub ]

The search is working fine, but returns two rows. The problem is that only one field in each row is populated from the search. It looks like this:
alt text

However, I cannot compare those two values, I think because of the empty fields in each row. Is there a way to get these in the same row or a better way to compare them? I have tried eval, where, and a lot of different ways to compare them. Any help is appreciated!

Tags (2)
0 Karma
1 Solution

kmattern
Builder

Make your subsearch appendcols instead of append. You'll get everything in one row.

earliest = -24h@h latest = @h | timechart span=1h count | stats stdev(count) as test | appendcols [ search earliest = -3h@h latest = @h | timechart span=1h count | stats stdev(count) as testsub ]

alt text

View solution in original post

kmattern
Builder

Make your subsearch appendcols instead of append. You'll get everything in one row.

earliest = -24h@h latest = @h | timechart span=1h count | stats stdev(count) as test | appendcols [ search earliest = -3h@h latest = @h | timechart span=1h count | stats stdev(count) as testsub ]

alt text

Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...