How do I compare for todays and yesterdays stats/ report?

[mikeyty07]

How do i compare for todays let say 9a-10a with yesterdays 9a-10a stats side by side? Is it possible on 1 qeury?

index=foo <query> | stats avg(responsetime) today and tomorrow count by uri
 

[gcusello]

Hi @mikeyty07,

try somerthing like this:

index=foo <query> earliest=-2d@d date_hour=9
| eval day=if(now()-_time<86400,"Today","Yesterday")
| stats avg(eval(if(day="Today",responsetime,""))) AS today avg(eval(day="Yesterday",responsetime,""))) AS yesterday BY uri

If you haven't date_hour, you have to extract it

index=foo <query> earliest=-2d@d 
| eval date_hour=strftime(_time,"%H")
| where date_hour=9
| eval day=if(now()-_time<86400,"Today","Yesterday")
| stats avg(eval(if(day="Today",responsetime,""))) AS today avg(eval(day="Yesterday",responsetime,""))) AS yesterday BY uri

Ciao.

Giuseppe