how can I find the average of a field in 2 different timeline

[SridharS]

Hi, I need to find the average value of a field at 2 different time. One is 4 days before and other is 1 day before. I used the below query but am not able to fetch the "1 day" before data. Any advice is appreciated!!

search........|stats avg(cpu_usage) as average| untable _time Metrics Value |eval Date=if(_time=relative_time(-1d,"-4d"), "Latest","Earliest") |chart first(Value) over Metrics by Date limit=0

[somesoni2]

After your stats there is no field called _time hence remaining search doesn't give the results you want. Try something like this

your base search | bucket span=1d _time | stats avg(cpu_usage) as average by _time | eval Date=if(_time=relative_time(now(),"-1d@d"), "Latest","Earliest") | eval Metrics="Average CPU Usage"  |chart first(Value) over Metrics by Date limit=0