Hi, I need to find the average value of a field at 2 different time. One is 4 days before and other is 1 day before. I used the below query but am not able to fetch the "1 day" before data. Any advice is appreciated!!
search........|stats avg(cpu_usage) as average| untable _time Metrics Value |eval Date=if(_time=relative_time(-1d,"-4d"), "Latest","Earliest") |chart first(Value) over Metrics by Date limit=0
After your stats there is no field called _time hence remaining search doesn't give the results you want. Try something like this
your base search | bucket span=1d _time | stats avg(cpu_usage) as average by _time | eval Date=if(_time=relative_time(now(),"-1d@d"), "Latest","Earliest") | eval Metrics="Average CPU Usage" |chart first(Value) over Metrics by Date limit=0