How can I concatenate tables from the same search at different time periods ?

[Clovisa]

Hi, I am trying to compare the top sales of the latest week to the top sales of the previous week.
I am trying to get a table that looks like :

Product   | Rank    | Rank previous week
Table     | 1       | 2
Chair     | 2       | 1

---

index=sales earliest=-2w latest=-w
| stats count as Sales by Product| sort -Sales
| table Product
| streamstats count as Rank

I succeeded in having the latest rank or the previous rank (see query above) but I don't see how I can combine them. Do you know how I could do this ? Thanks !

[renjith_nair · Accepted solution]

Hi @Clovisa,

Try

index=sales earliest=-2w latest=@w|bucket span=1w _time
 |stats count as Sales by Product,_time|sort _time,-count
 |streamstats count as rank by _time
 |sort Product
 |streamstats current=f last(rank) as prev_rank by Product reset_on_change=true|where prev_rank!=""
 |table Product,rank,prev_rank|sort rank

[Clovisa]

It is perfect, thanks a lot 😄