Join two statistics tables without subsearch

[sbarinov]

Hi,

I am trying to compare event type count statistics for 2 days using the following search:

earliest=-48h latest=-24h | stats count as count1 by eventtype | table eventtype, count1 | join eventtype [search earliest=-24h latest=now() | stats count as count2 by eventtype | table eventtype, count2] | eval diff=(count2-count1)  | table eventtype, diff | sort diff

Is there any option to do this without using subsearch and join?

Thanks.

[ITWhisperer · Accepted solution]

earliest=-48h latest=now()
| eval period=floor((now()-_time)/(24*60*60))
| stats count(eval(period=1)) as count1 count(eval(period=0)) as count2 by eventtype
| eval diff=count2-count1
| table eventtype diff
| sort diff

[sbarinov]

@ITWhisperer  Thank you!