logcompare
Use the logcompare command to compare the current time
window against a baseline window shifted back by a specified
duration.
Syntax
| logcompare timeshiftduration
The command uses the following arguments:
-
timeshiftâ The duration to shift back for the baseline window (for example,duration7d).
Example
The following query compares the past day's logs against the same period one week earlier.
SOURCE lg start=-1d end=now | logcompare timeshift 7d
