I have a use case, where in I need data from different dates compared to previous days. so, I have a time picker and a previous days dropdown with 1,2,3,4,5,6,7,8,9,10 days option.
e.g. there may be a case where in I need to compare today with last 5 days. So, I will select today from time range and previous 5 days from dropdown.
case 2. : I can select date range from time picker and then compare with any number of days.
I used join: index=abc earliest=$time_tok.earliest$- $days_selected$ latest=$time_tok.earliest$|stats count(host) by source|join type=left source[index=abc earliest=$time_tok.earliest$ latest=$time_tok.latest$|stats count(host) by source].
tried using daysago as well, but it is very very slow.
Please provide some pointers.
Best,
... View more