I would like to find the difference between values in a couple of fields for two months.
I figured out how to do that just for one field:
|set diff [search index = test_im REPORT_PERIOD="2015-10-01 00:00:00"| stats count by Client Type Type2| fields - count] [search index = test_im REPORT_PERIOD="2015-09-01 00:00:00"| stats count by Client Type Type2 | fields - count]
However, for a couple fields, it's not working properly. It would be nice if the result looked like this (unique difference values):
Client Type Type2
<difference unique values> <difference unique values> <difference unique values>
Here is the option that you can use. I assume you have a variables called REPORT_PERIOD. Then you can use join or depends on visualization and your needs you can also use appendcols command.
search index = test_im REPORT_PERIOD="2015-10-01 00:00:00"| stats count by Client Type Type2|fields - count |join REPORT_PERIOD [search index = test_im REPORT_PERIOD="2015-09-01 00:00:00"|stats count by Client Type Type2|fields - count] |table Client,Type,Type2
You can find more details from the link below.
Hope it is clear.
Unfortunately this is not working. I want to see the different unique values which are exist in one data set and not exist in second one.
e.g. If a new client appear in new month this need to be shown
or if a client which exists in previous month but in current month is not visible
Thank you with helping here
Is there any chance to give those data set tables as an example?
Is it logged clients or new user registration data? I mean you can see the 1 person information more than 1 time in 1 data set in the same period?