Hey, right now I am a bit messed up in the mind and not sure if I try to find an overly complicated solution to a maybe fairly simple problem. Secanrio is; I have a set of historical stock market prices (Ticker, Close-price, Volume). I want to extract several information here: 1. The %Change of a given day compared to the previous (work) day and the respective volume. Additionally the time frame should be defined relatively (set only the date fix, but the range flexible). Table that for the Top10 with their respective volume that day. 2. Use the ouput from above to generate a similar set but now with 1day, week, month later then the given day, but only for the Top10 above and combine that into one result table Desired outcome: Ticker %-Change -1d Volume %-Change +1d %-Change +1w AAA 5.0 10000 1.0 -8.0 BBB 3.0 50000 4.0 4.5 CCC 1.0 70000 -1.0 3.0 I think I solved part 1 with: index=market_price Close!=""
[
search latest="6/23/2020:00:00:00"
| addinfo
| head 1
| eval latest=info_max_time+86400
| eval earliest=info_max_time-86400
| fields earliest,latest
| format "(" "(" "" ")" "OR" ")"
]
| bin span=1d _time
| stats avg(Close) as Close avg(Volume) as Vol by _time Ticker
| streamstats global=f current=f first(Close) as p_close by Ticker
| eval delta=round(((Close-p_close)/p_close)*100,2)
| where delta!=""
| eval Amount_in_Mio=round((Close*Vol)/1000000,0)
| where Amount_in_Mio>2000
| table Ticker delta Amount_in_Mio
| sort - delta |head 10 Part 2 I can get a set of results for the day after, but not based on the Top 10 from above: index=market_price Close!=""
[
search earliest="6/23/2020:00:00:00"
| addinfo
| head 1
| eval latest=info_min_time+86400
| eval earliest=info_min_time-86400
| fields earliest,latest
| format "(" "(" "" ")" "OR" ")"
]
| bin span=1d _time
| stats avg(Close) as Close avg(Volume) as Vol by _time Ticker
| streamstats global=f current=f first(Close) as p_close by Ticker
| eval delta=round(((Close-p_close)/p_close)*100,2)
| where delta!=""
| table Ticker delta
| sort - delta |head 10 I think right now, I think I would need to combine several sub searches for relative times, the first Top10 and the subsequent datasets. Not sure If I moved myself into a dead end here, so any suggestions are welcome. Thanks
... View more