Hi,
I have the below SPL and I would like to get the comparison for 15 mints time span i.e if we run today at 5 am then we should expect the table like for every 15 mints data count vs yesterday same time count. Please could you help?
Current SPL:
basesearch earliest=-3d@d latest=now
| eval date_wday=strftime(_time,"%A")
|search NOT (date_wday=Saturday OR date_wday=Sunday)
| eval last_weekday=strftime(now(),"%A")
| eval previous_working_day=case(match(last_weekday,"Monday"),"Friday",match(last_weekday,"Tuesday"),"Monday",match(last_weekday,"Wednesday"),"Tuesday",match(last_weekday,"Thursday"),"Wednesday",match(last_weekday,"Friday"),"Thursday")
| where date_wday=last_weekday OR date_wday=previous_working_day
| eval DAY=if(date_wday=last_weekday,"TODAY","YESTERDAY")
| chart count by Name,DAY
| eval percentage_variance=abs(round(((YESTERDAY-TODAY)/YESTERDAY)*100,2))
| table Name TODAY YESTERDAY percentage_variance
... View more