You can do several things. If you only need to compare two time periods ad see if there is a difference, you can use multisearch . Something like this might work:
| multisearch
[ search <your-search-to-get-data> earliest=-30m@m latest=-15m@m
| eval type=first]
[ search <your-search-to-get-data> earliest=-15m@m latest=-0m@m
| eval type=next]
| stats values(<field-you-want-to-compare>) as val
| eval diff=if(mvindex(val,0)!=mvindex(val,1),1,0)
This can take any time periods that you want, for example, you can set it to the same time on the previous day to be compared with the value today, so it is general in nature. Just set the earliest and latest times appropriately. The stats command makes a multivalue field that can then be used with the eval. The mvindex function let's you grab the two values that you get and set the difference in the field diff . If the value of diff is 1, then they are different, and if 0, then the same. This is a very generalized way to handle doing this. There are many ways to make it more efficient or effective.
You don't really need the eval type="first" or eval type="last" . It just makes it possible to see the values separately. Don't worry about getting hung up on what it does, because in this case it doesn't really do anything, but it could be useful in some circumstances.
... View more