So I have a query which returns a value over a period of 7 days The below is like the query but took a few items out index=xxxx search xxxxx | rex field=_raw "projects/\\s*(?<ProjectID>\d+)" | rex field=_raw "HTTP\/1\.1\ (?P<Status_Code>[^\ ]*)\s*(?P<Size>\d+)\s*(?P<Speed>\d+)" | eval MB=Size/1024/1024 | eval SecTM=Speed/1000 | eval Examplefield=case(SecTM<=1.00, "90%")| stats count by Examplefield | table count I can get the single value over 7 days I want to be able to do like a comparaison over the previous 7 days So lets number is 100,000 and prevous week was 90,000 then it shows up 10,000 or vice versa if that makes sense. I have seen the Sample Dashboard with Single Value with an arrow going up or down but I just have no clue how to syntax the time bit
... View more