You could do this:
index=_internal earliest=-1w@d latest=@d | top source | join source [search index=_internal earliest=-2w@d latest=-1w@d | top source | rename count as previous_count percent as previous_percent] | eval delta = count - previous_count
Modify to fit your data and desired output.
You could do this:
index=_internal earliest=-1w@d latest=@d | top source | join source [search index=_internal earliest=-2w@d latest=-1w@d | top source | rename count as previous_count percent as previous_percent] | eval delta = count - previous_count
Modify to fit your data and desired output.
Thanks! That was definitely the right approach. I massaged it a bit to give a delta of rankings:
sourcetype=search earliest=-1d@d latest=@d | top search_query limit=100 | eval rank = 1 | accum rank | join search_query [search sourcetype=search earliest=-2d@d latest=-1d@d | top search_query limit=500 | eval prev_rank = 1 | accum prev_rank | rename count as prev_count percent as prev_percent] | eval delta = "+" . (prev_rank - rank) | replace "+-" with "-" in delta | replace "+0" with "--" in delta | table delta search_query count percent