Compare Command

Use the compare command to compare properties generated by the link command over the comparison intervals specified.

Syntax

compare [fields=<field> [,<field>]*] [timeshift = <offset> [size = <size>][count=<int>] | timerange <datetime> to <datetime> [as <new_field_name>], ...]

Parameters

The following table lists the parameters used in this command, along with their descriptions.

Parameter	Description
offset	<direction><int><timescale> Sets comparison time range as an offset of the current time range. direction syntax: + | - timescale syntax: <sec> | <min> | <hour> | <day> | <week> | <mon> sec syntax: s | sec | secs | second | seconds min syntax: m | min | mins | minute | minutes hour syntax: h | hr | hrs | hour | hours week syntax: w | week | weeks month syntax: mon | month | months
size	<int><timescale> Sets the size of the length of time of the comparison time range. timescale syntax: <sec> | <min> | <hour> | <day> | <week> | <mon> sec syntax: s | sec | secs | second | seconds min syntax: m | min | mins | minute | minutes hour syntax: h | hr | hrs | hour | hours week syntax: w | week | weeks month syntax: mon | month | months
datetime	Explicitly sets start and end of a comparison time range.

For example of using this command in typical scenarios, see:

• Compare Link Metrics Across Time in Using Oracle Log Analytics

The following command compares average content size of an entity from 7 days ago and from 14 days ago:

* | link Entity 
| stats avg('Content Size') as 'Average Content Size' 
| compare fields = 'Average Content Size' timeshift = -7d count = 2

The following command compares average content size of an entity from another period of time:

* | link Entity 
| stats avg('Content Size') as 'Average Content Size' 
| compare fields = 'Average Content Size' 
        timerange = '2018-06-07T00:00:00Z' to '2018-06-14T00:00:00Z' as T1