Alerting

How create an alert to compare yesterday and today and show the difference for a value?

vrmandadi
Builder

I am trying to create an alert which will compare yesterday and today for a particular field and show what is the difference.

 

I want to count the total for field called "id" for today and compare the count with yesterday and show the count difference and the id's which are different .

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

See if this helps at all.

index=foo earliest=-1d@d latest=@d
| stats count as yesterday by id
| append [ search index=foo earliest=@d latest=now | stats count as today by id ]
| stats values(*) as * by id
| eval diff = today - yesterday
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

See if this helps at all.

index=foo earliest=-1d@d latest=@d
| stats count as yesterday by id
| append [ search index=foo earliest=@d latest=now | stats count as today by id ]
| stats values(*) as * by id
| eval diff = today - yesterday
---
If this reply helps you, Karma would be appreciated.
0 Karma

vrmandadi
Builder

Thank You

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...