timecompare
Use the timecompare command to generate columns with the
        results from all the aggregate columns generated by the previous timestats
        command over the comparison interval specified. Note that timecompare
        command must follow a timestats command.
               
Syntax
timecompare shift=<int><timescale> [count=<int>]Parameters
The following table lists the parameters used in this command, along with their descriptions.
| Parameter | Description | 
|---|---|
| 
 span  | 
 Syntax:  Sets the size of each compare window using a span length based on time.  | 
| 
 
  | 
 Syntax:  where: <sec>: Seconds. Syntax:  <min>: Minutes. Syntax:  <hour>: Hours. Syntax:  <day>: Days. Syntax:  <week>: Weeks. Syntax:  <month>: Months.  | 
The following command compares the log volume by the number of log lines week over week.
* | timestats span=1d count | timecompare shift=1w
The following command compares the count of errors by an entity week over week.
Severity = error | timestats span=1d count by Entity | timecompare shift=5days 2";