Splunk Search
Highlighted

How to compare same field values at different times?

Communicator

How can I do a comparison with values from same field at different times? The logs belongs to the same index/sourcetype. There's a field called lagtime which basically denotes how long it took to complete a process/action. Goal is to compare the lagtime at current time with lagtime in past 12 hours and display the results only if there is no match.

0 Karma
Highlighted

Re: How to compare same field values at different times?

Legend

Try this

... earliest=-12h@h | eventstats latest(lagtime) as currentlagtime | where currentlagtime!=lagtime | ...
0 Karma
Highlighted

Re: How to compare same field values at different times?

Splunk Employee
Splunk Employee

Can you give us sample logs?

0 Karma