I need to compare the search results for my search criteria !
Example search criteria : host="iadtypweb*" | stats dc(session_id) as sessioncount, values(session_id) as sessionname
(I can specify the time in the Time Filter for the search)
The search criteria provides me the result of distinct session id and its value with respect to the host value specified. If this search is done on Saturday , and when I require to search this for Sunday , I need to find the occurrences of the event that do not match with Saturday results !
So it is possible to do this ? Do we have any built in functionalities to do this ?
If so provide me the sample query.
... View more