HI,
I'm running a search for two different timeranges, for missing datapoint pair it's creating discrepancy with my calculations.
I need accurate diff so fillnull value is not an option, I would prefer want to remove _time row if it's missing a pair for the same timestamp, any hints appreciated.
Got an idea with below but despite moving around my stats
| stats count values(marker) as pairstamp by _time
| where count=2
my search is:
earliest="4/1/2024:00:00:00" latest="8/1/2024:00:00:00"
| bin span=1h _time
| addinfo
| eval marker = if(_time < (relative_time(info_min_time,"+1mon@mon")), "April", "July")
| eval _time = if(_time < (relative_time(info_min_time,"+1mon@mon")), _time + 91*24*3600, _time)
...
| where _time>=relative_time(now(), "-1mon@mon")
| stats max(sig_value) as signature by _time marker
| delta signature as diff_delta
Try using eventstats
| eventstats count by _time
| where count=2