How do I display mismatch data between last 30days data to last 15mnts data?

[lucky]

please help I need to compare and display the last 30days data and last 15mnts data 

[lucky]

Last 30days         last 15mnts.               Diff

 App instance id   app instanceid.    App id 

• Please help above format 

[yuanliu]

Pro tip: Always show sample data, attempted code, and desired output (mockup). We could have saved tons of time if you presented this table in the first place.

OK.  So, here are two ideas.

search earliest=-30d
| eval period = mvappend("30days", if(_time > relative_time(now(), "-15m"), "15minutes", null()))
| stats values(period) as period by App_server_instance_ID
| eval diff = if(mvcount(period) < 2, App_server_instance_ID, null())
| stats values(App_server_instance_ID) as App_server_instance_ID values(diff) as diff by period

This gives you a vertically laid out presentation like

period	App_server_instance_ID	diff
15minutes	22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37
30days	0 1 10 11 12 13 14 15 16 17 18 19 2 20 21 22 23 24 25 26 27 28 29 3 30 31 32 33 34 35 36 37 38 39 4 40 41 42 43 44 45 46 47 48 49 5 50 51 52 53 54 55 56 57 58 59 6 7 8 9	0 1 10 11 12 13 14 15 16 17 18 19 2 20 21 3 38 39 4 40 41 42 43 44 45 46 47 48 49 5 50 51 52 53 54 55 56 57 58 59 6 7 8 9

If you really prefer a horizontally laid table,  do a transpose

index=_internal earliest=-2d
| eval period = mvappend("30days", if(_time > relative_time(now(), "-15m"), "15minutes", null()))
| rename date_minute as App_server_instance_ID
| stats values(period) as period by App_server_instance_ID
| eval diff = if(mvcount(period) < 2, App_server_instance_ID, null())
| stats values(App_server_instance_ID) as App_server_instance_ID values(diff) as diff by period
| transpose header_field=period

column	15minutes	30days
App_server_instance_ID	21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36	0 1 10 11 12 13 14 15 16 17 18 19 2 20 21 22 23 24 25 26 27 28 29 3 30 31 32 33 34 35 36 37 38 39 4 40 41 42 43 44 45 46 47 48 49 5 50 51 52 53 54 55 56 57 58 59 6 7 8 9
diff		0 1 10 11 12 13 14 15 16 17 18 19 2 20 3 37 38 39 4 40 41 42 43 44 45 46 47 48 49 5 50 51 52 53 54 55 56 57 58 59 6 7 8 9

It is doable to place diff on the header.  But this layout is more comprehensible IMHO.

[lucky]

I have one index and source...in that I have two fields  1.App_server_instance_ID 2. App_server_hostname 

|stats count by App_server_instance_ID   App_server_hostname    last30days ....showing 39 events

|stats count by App_server_instance_ID   App_server_hostname     last 15mnts....showing 32 events only

I need to display 7 missing events in the dashboard

please help me

[yuanliu]

Interestingly, someone asked a similar search very recently but I can't find it now.

The way I picture this is to label the two periods. Obviously, last 30 days contains last 15 minutes, so we can simply label the last 15 minutes.   I have a suspicion that your actual stats is different from simple count.  But for count, you can do

search earliest=-30d
|stats count as 30days sum(eval(if(_time > relative_time(now(), "-15m"), 1, 0))) as 15minutes by App_server_instance_ID App_server_hostname
| eval diff = '30days' - '15minutes'

Other stats can be similarly maneuvered

[lucky]

Thank you so much...

but i need display only App-instance-id 

Differences

Can you please help on this

[yuanliu]

You need to be more specific about your requirements.  The code was based on your code snippet.  One way to drop App_server_hostname is to simply drop it.  As to display, you can use table, fields, or fields -.

search earliest=-30d
|stats count as 30days sum(eval(if(_time > relative_time(now(), "-15m"), 1, 0))) as 15minutes by App_server_instance_ID
| eval diff = '30days' - '15minutes'
| table App_server_instance_ID diff

This may or may not be what you needed, but it fits what you said.

[lucky]

Thanks a lot..

My requirement is 

No need to show diff count if instance-id's

When i run the query with last 30 days..instance id's showing ..39events

But taking last 15mnts ..the instance id showing ..34events.. need show only 39-34 =5 instance id s names we need display..

So need show non-traffic list instance id..of differences ids only 

Could you please help on this ...

Thanks.

[PickleRick]

As I said - just set your search timerange to include only events from 15 minutes ago to 30 days ago and you're good to go. Don't overcomplicate things.

Unless you want something more than just listing the events. it's not clear what those instance ids are and how they relate to the events themselves. And how those time ranges "interact" with each other - are the instance ids unique to each single event? Or are they repeatable? If so, can they be "carried over" to the "last 15 minutes period"? If so - do you want them listed in such case or do you want only those ones that didn't appear during last 15 minutes.

Your requirements are not very precise so it's hard to meet them.

[PickleRick]

Since the difference comes from the different timeframe, you can just look into your index and either set

earliest=-30d latest=-15m

as your search parameters. Like

index=myindex source=mysource earliest=-30d latest=-15m

Or simply search across your index

index=myindex source=mysource

and set the appropriate time range in the timepicker.

Unless there's more to it and I don't understand it 🙂

[yuanliu]

Maybe start by explaining what does "compare and display last 30days data and last 15mnts data" mean?  How does this comparison/display look like?