Compare Command
Use the compare
command to compare properties generated by
the link
command over the comparison intervals specified.
Syntax
compare [fields=<field> [,<field>]*] [timeshift = <offset> [size = <size>][count=<int>] | timerange <datetime> to <datetime> [as <new_field_name>], ...]
Parameters
The following table lists the parameters used in this command, along with their descriptions.
Parameter | Description |
---|---|
|
<direction><int><timescale> Sets comparison time range as an offset of the current time range.
|
size |
<int><timescale> Sets the size of the length of time of the comparison time range.
|
|
Explicitly sets start and end of a comparison time range. |
For example of using this command in typical scenarios, see:
- Compare Link Metrics Across Time in Using Oracle Log Analytics
The following command compares average content size of an entity from 7 days ago and from 14 days ago:
* | link Entity
| stats avg('Content Size') as 'Average Content Size'
| compare fields = 'Average Content Size' timeshift = -7d count = 2
The following command compares average content size of an entity from another period of time:
* | link Entity
| stats avg('Content Size') as 'Average Content Size'
| compare fields = 'Average Content Size'
timerange = '2018-06-07T00:00:00Z' to '2018-06-14T00:00:00Z' as T1