opensearch_compare
Compare top values of a field between two time windows to detect new patterns, increased or decreased activity, or disappeared sources. Computes diff and percent change automatically.
Instructions
Compare the top values of a field between two time windows.
Prefer over calling opensearch_terms twice manually — computes the diff and percent change automatically. Use to detect new patterns, increased/decreased activity, or disappeared sources between a baseline and a selection period.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| size | No | Top N values to fetch per window (default 20). | |
| field | Yes | Keyword field to compare, e.g. "rule.id", "agent.name", "data.srcip". | |
| index | Yes | Index name or wildcard pattern. | |
| ts_field | No | Timestamp field (default "@timestamp"). | @timestamp |
| baseline_to | Yes | Baseline window end, UTC ISO 8601. | |
| query_string | No | Lucene filter applied to both windows (default "*"). | * |
| selection_to | Yes | Selection window end, UTC ISO 8601. | |
| baseline_from | Yes | Baseline window start, UTC ISO 8601. | |
| selection_from | Yes | Selection window start, UTC ISO 8601. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||