Hi,
My goal is to compare today's count, say Monday, to the previous Monday. Also, compare the previous week's Monday to the week before that, same day. This is performed everyday over a 2-week window.
If I run these 2 searches below separately, the data is not lost. Interestingly, only the first few days of the earliest week, same days, are lost in the 2nd search when using appendcols.
My search:
index=dataset earliest=-14d@d latest=@d method="00001111"
| bucket _time span=1d
| dedup TRANSACTIONID
| stats dc(users) as CurrentCount by _time
| eval Date=strftime(_time, "%F")
| appendcols
[search index=uxi earliest=-21d@d latest=-7d@d method="00001111"
| bucket _time span=1d
| dedup TRANSACTIONID
| stats dc(users) as PreviousWkCount by _time
Example:
Results (2 weeks) with lost data from 07/11 to 07/13 when using appendcols in the 2nd search. These aren't real numbers.
Date Day CurrentCount PreviousWkCount
07/11/2017 Tues 10000 5000 <== Count is not accurate in appendcols
07/12/2017 Wed 10000 5000 <== Count is not accurate in appendcols
07/13/2017 Thurs 10000 5000 <== Count is not accurate in appendcols
07/14/2017 Fri 10000 10000 <== Ok
07/15/2017 Sat 10000 10000 <== Ok
...
...
07/24/2017 Mon 10000 10000 <== Ok
Thanks,
... View more