How to eliminate identical values of two similar fields?

[vshakur]

Suppose I have a field called TESTS which contains some values. This field changes every day (each day is represented by a field called TIMESTAMP).
I would like to isolate only those tests that differ from previous day to the following. Only those tests that appeared yesterday but not today.

For instance:
| tests | day |
|--------| ------|
| a,b,c | 1 |
|--------|-------|
| a,c | 2 |

The DIFFERENCE field should contain only b

Thanks,
Shmuel

[elliotproebstel]

I'm going to focus on your final goal statement, which is to find: "Only those tests that appeared yesterday but not today." I'll assume that each test appears in a field called test.

Step 1: List all tests that occurred in the overall timeframe (yesterday and today)

index=something earliest=-1d@d latest=now test=*

Step 2: Identify the latest time that each test ran

| stats latest(_time) AS last_ran BY test

Step 3: Filter for tests that ran yesterday and did not run today

| eval midnight=relative_time(now(), "@d")
| where last_ran<=midnight

This will leave tests that were seen within the overall time window but were not seen today. So putting it all together:

index=something earliest=-1d@d latest=now test=*
| stats latest(_time) AS last_ran BY test
| eval midnight=relative_time(now(), "@d")
| where last_ran<=midnight

The solution by @p_gurav will display all events that occurred on only one day (i.e. only yesterday OR only today), but it won't tell you on which day they ran.

[p_gurav]

Hi vshakur,

You can try following query:

| set diff [search index=* earliest=-0d@d latest=now | stats count by tests | fields - count] [search index=* earliest=-1d@d latest=@d| stats count by tests | fields - count]