How to find difference in value between search strings?

[Gowtham0809]

Hi,

I am using a single search string with two different time rage to find the disk space.

Search string : index= source="PerfmonMk:Free Disk Space" "%_Free_Space"="*" E | eval volume=Free_Megabytes/1024 | chart avg(volume)
1. Time range of last 24 hours
2. Time range of Previous month

By using this I am getting two different charts as output.

I need the string to find the difference between these two charts. or a single string to define the disk space of current day and 30 days before (previous month)

Thanks,

[jkat54 · Accepted solution]

How about this?

index_earliest=-1d@d index=index source="PerfmonMk:Free Disk Space" "%_Free_Space"="*" E 
| eval volume=Free_Megabytes/1024 
| bin _time bins=30 
| stats avg(volume) as daily_Kilobytes by _time
| append 
 [
 search index_earliest=-1mon@mon index_latest=@m index=index source="PerfmonMk:Free Disk Space" "%_Free_Space"="*" E 
| bin _time span=1d
| eval volume=Free_Megabytes/1024 
| stats avg(volume) as monthly_Kilobytes by _time
 ]
| timechart values(daily_Kilobytes) values(monthly_Kilobytes) 

[DalJeanis]

@jkat54 - m is minute. Probably need to use -30d@d.

[Gowtham0809]

Thank you and it worked

[jkat54]

i always do that, thanks... updated to mon for month

[adonio]

how about using timechart command? set the timepicker to last 30 days

 index= source="PerfmonMk:Free Disk Space" "%_Free_Space"="*" E | eval volume=Free_Megabytes/1024 | timechart span=24h avg(volume)

hope it helps

[Gowtham0809]

Thank you and it worked