Line by line explanation, so you can see what is going on...
(search for todays-or-yesterday's data)
Your search needs to return a value for _time which is sometime today or yesterday, a value for url, and a value for hash. For example, it should be returning a record for yesterday for myurl.com, and a record for today for myurl.com
This command gets rid of everything but those three fields
| table _time url, hash
This command makes sure the _time contains only the day value... we dont' care about the time
| bin _time span=1d
These commands create a multivalue field named "splitter", give it two values A and B, and then copy the entire url-hash record into one record for A, and one record for B
| eval splitter="A B" | makemv splitter | mvexpand splitter
This command adds one day (86400 seconds) to the _time of the B record. The effect of this is that yesterdays records will have an A record with yesterday's data adn a B record with today's date. Today's records will have an A record with today's date, and a B record with tomorrow's date.
| eval _time=if(splitter="A",_time,_time+86400)
This rolls together the values for each URL for each day for all fields except _time and url. The values() aggregate command will only retain distinct values, so if the hash has not changed, there will only be one value. Also, if the date is yesterday or tomorrow, there will only be one record, so only one value.
| stats values(*) as * by _time url
This kills all the records that have only one value.
| where mvcount(hash)>1
The result will be only records that had one hash value yesterday, and have another hash value today.
You've already accepted an answer, but I went ahead and posted a search in my original answer that you should be able to cut-and-paste to execute. You can paste it in line-by-line and execute the search -- with | head 5 after it or with target_page=someparticularpage.com so you don't get too much output -- and see how each command transforms the results.
sourcetype=logs target_page_hash=* earliest=-2d
| table _time target_page, target_page_hash
| bin _time span=1d
| eval splitter="A B" | makemv splitter | mvexpand splitter
| eval _time=if(splitter="A",_time,_time+86400)
| stats values(*) as * by _time target_page
| where mvcount(target_page_hash)>1
... View more
