logcompare
Use the logcompare command to compare the current time
window against a baseline window shifted back by a specified
duration.
Syntax
| logcompare timeshiftduration
The command uses the following arguments:
-
timeshift– The duration to shift back for the baseline window (for example,duration7d).
Example
The following query compares the past day's logs against the same period one week earlier.
SOURCE lg start=-1d end=now | logcompare timeshift 7d
