index=_internal type=usage idx=wineventlog | bucket span=1d _time | stats sum(b) as sum by h,_time
The above query gives the sum for "b" values over a period of one day. If I run the query for time period of two days I get two sums for "h". Difference between these two sums need to be found.
I found an alternative which worked for me-
index=_internal type=usage idx=wineventlog | chart sum(b) by h date_wday | eval diff=sunday-tuesday | eval diff=abs(diff) | sort -diff
the date_* fields are not considered authoritative from an accuracy standpoint, and your query will only work as long as you have queries less than one week (non-overlapping days of the week).
Look at the last answer in this post
index=_internal type=usage idx=wineventlog | bucket span=1d _time | stats sum(b) as b by h,_time | streamstats current=t global=f window=2 latest(b) as curr earliest(b) as next by h | eval delta=next-curr | timechart span=1d sum(delta) as delta by h