So I want to find the difference of a value between 2 searches.
The first search grabs score by last name on 2 weeks prior:
score source=scores.py latest=-20160m | stats count as previous by name
so the statistics table would look like this:
Name | Score
1. Smith | 76
2. Jackson | 80
3. Monroe | 95
The second search grabs the most recent score by last name:
score source=scores.py | stats count as previous by name
so the statistics table would look like this:
Name | Score
1. Smith | 79
2. Jackson | 85
3. Monroe | 90
I want it to ultimately look like this:
Name | previous | cur | Change
1. Smith | 76 | 79 | 3 |
2. Jackson | 80 | 85 | 5 |
3. Monroe | 95 | 90 | -5 |
Here is the search I have now:
score source=scores.py latest=-20160m | stats count as previous by name | eval cur=[ search score source=scores.py | stats count as cur by name | rename cur as query ]
I get this error "Error in 'eval' command: Typechecking failed. 'AND' only takes boolean arguments". Im thinking its because i have "by" in my eval. Anyone have any idea how I can achieve this? At my wits end >_____<
... View more