How can I do a comparison with values from same field at different times? The logs belongs to the same index/sourcetype. There's a field called lagtime which basically denotes how long it took to complete a process/action. Goal is to compare the lagtime at current time with lagtime in past 12 hours and display the results only if there is no match.
Can you give us sample logs?
Try this
... earliest=-12h@h | eventstats latest(lagtime) as currentlagtime | where currentlagtime!=lagtime | ...