I want to calculate the amount of change in between today's score and yesterdays.
This is a file with a few days data. Using Score field, calculate calc I want to document the change in calc.
I'm just trying with below one but it's not showing the way I want.
| inputlookup FinalScore.csv
| where date = "2/14/2018" or date = "2/15/2018"
| eval _time= strptime(date, "%m/%d/%Y")
|eval nowstring=strftime(now(), "%m/%d/%Y")
| eval test = "2018-02-19"
| eval temp=if(_time='2018-02-15', "today","yesterday")
| eval percent=case(DataSource=="DoP", 0.317757009, DataSource=="VxN", 0.196261682, DataSource=="Phishing", 0.112149533, DataSource=="BCOAT", 0.121495327, DataSource=="IPORT", 0.252336449)
| eval calc = percent*Score
| timechart span=1d sum(calc) by User
... View more