Hi
need to compare total numbers if they are different show table that present them
23:57:05.253 app module: PACK: Total:[1010000] from server1 Total:[C000001010000]
23:57:05.254 app module: PACK: Total:[1010000] from server1 Total:[C000001000000]
diff=second total - first total
expected output:
Time diff
23:57:05.254 10000
any idea?
Thanks,
after workaround do this with eval command.
index="myindex"
| eval diff=(total2 - total1)
| table _time diff
after workaround do this with eval command.
index="myindex"
| eval diff=(total2 - total1)
| table _time diff