---
id: compare
title: compare Search Operator
sidebar_label: compare
description: Use the compare operator to compare current aggregate query results against one or multiple past time periods.
slug: /help/docs/search/search-query-language/search-operators/compare/
canonical: https://www.sumologic.com/help/docs/search/search-query-language/search-operators/compare/
---

import useBaseUrl from '@docusaurus/useBaseUrl';

The `compare` operator can be used with the [**Time Compare**](/docs/search/time-compare) button in the Sumo interface, which automatically generates the appropriate syntax and adds it to your aggregate query. The following information can also be found documented in Time Compare.

You can use `compare` to:

* Evaluate the performance metrics of a website, such as the latency or the number of exceptions, before and after a deployment.  
* Track the root cause of a production issue quickly by tracking specific keywords, such as memory exceptions, and comparing them with historic data to find any anomalous trends.
* Compare the daily active or weekly active users on your website for strategic business insights.
* Identify malicious activity or attacks by comparing failed login attempts against past averages.

Use the compare operator in the following ways:

* Compare with a single time period in the past.
* Compare with multiple time periods in the past.
* Compare with an aggregate over multiple time periods in the past.

By default, results are displayed in the **Aggregates** tab on the search page in a table. Each column of the output table contains results from one of the specified queries. The first column is suffixed with the keyword **target**, appended to the original column name, and contains results from the present time (or the time range specified in the time range field). Additional columns are suffixed by the timeshift (the period shifted back in time) of the queries. From here, you can select a chart type to display results visually.

For example, if you were doing a comparison with yesterday, when you use the compare operator after the count operator, the aggregation table results will display the column names `count_target` and `count_1d`.

## Syntax

### Single Comparison

Compare the present results with a single time period in the past. To make the comparison, specify the time interval you want to go back, in the form of number and time granularity:

`... | compare timeshift <number><time granularity>`

The following query returns data from the present, along with results from yesterday. Here the parameter `1d` specifies the time interval we want to go back to get the data for the comparison.

```sumo
`... | compare timeshift 1d`
```

This comparison can be displayed visually as:

<img src={useBaseUrl('img/reuse/query-search/compare_single_diagram.png')} alt="Compare single diagram" style={{border: '1px solid gray'}} width="300" />

In another example, this query returns data from the present along with results from last week.

```sumo
... | compare timeshift 1w
```

### Multiple Comparison

Compare the present results with multiple time periods in the past. The first parameter specifies the time interval between the present query and the most recent comparison point. The second parameter specifies how many comparison points to create.

`... | compare timeshift <number><time granularity> <number of timeshifts>`

The following query returns results from the present, along with results from every day of the past week. The first parameter, 1d, specifies the interval between the points of comparison, and the second parameter, 7, specifies the number of comparisons.

```sumo
... | compare timeshift 1d 7
```

Which can be displayed visually as:

<img src={useBaseUrl('img/reuse/query-search/compare_multiple_diagram.png')} alt="Compare multiple diagram" style={{border: '1px solid gray'}} width="800" />

The following query returns result from the present with results from the same day in the last 3 weeks. So if today is Monday, then this query will show a result for today and the last three Mondays.

```sumo
... | compare timeshift 1w 3
```

### Aggregate Comparison

Aggregate the results from multiple past time periods using an aggregation operator (`avg`, `min`, or `max`).

`... | compare timeshift <number><time granularity> <number of shifts <avg/min/max>`

The following query returns results from the present along with the average of the results from the last five days:

```sumo
... | compare timeshift 1d 5 avg
```

Which can be displayed visually as:

<img src={useBaseUrl('img/reuse/query-search/compare_aggregate_diagram.png')} alt="Compare aggregate" style={{border: '1px solid gray'}} width="600" />

Other examples:

* Maximum of the same day for last three weeks: `... | compare timeshift 1w 3 max`
* Minimum of the last four six-hour intervals: `... | compare timeshift 6h 4 min`

### Advanced

You can also do multiple different comparisons queries under the same compare operator by using multiple timeshift phrases separated by commas.
`... | compare\<comparison >,\<comparison >, ...`

For example:

```sumo
... | compare timeshift 12h, timeshift 1d 3 avg, timeshift 1w
```

You can specify an alias, and the columns generated use the name you specify.

`... | compare <comparison 1>, <comparison 2>, ...`

For example:

```sumo
... | compare timeshift 1d as yesterday, timeshift 1w 4 as last_four_weeks
```

## Rules

* The compare operator must follow a group by aggregate operator, such as: `count`, `min`, `max`, or `sum`.
* If you want to use `timeslice` with `compare`, do not alias `timeslice`.

### Limitations

* Compare cannot generate more than **seven** additional queries. An additional query is generated whenever a comparison in time is initiated. Note that multiple comparisons and aggregate comparisons will generate multiple queries. For example, the following queries are not allowed:

    ```sumo
    ... | compare timeshift 1d 14
    ```

    This query compares with the past 14 days data. It is not allowed as it generates 14 queries. 

    ```sumo
    ... | compare timeshift 1d 5 avg, timeshift 1w  4
    ```

    This query compares with the last five days, and the same day for the last four weeks. It is not allowed as it generates 9 queries. 

* Duplicate aliases are not allowed. For example, the following query is not allowed:

    ```sumo
    ... | compare timeshift 1d 7 as last_week, timeshift 1d 7 avg as last_week
    ```

* Real-time queries using time compare need to have at least three timeslices within its time range. For example, if the time range is 10 minutes, your timeslices need to be no longer than 3 minutes so that there are at least three of them.
* Compare is not supported in Scheduled Views.
* Compare can only be used once in a search query.

## Examples

### Compare time series data with past data

Use compare to analyze the change in log counts between two days.

```sumo
error
| timeslice by 1h
| count by _timeslice
| compare timeshift 2d
```

The query returns results from both today and two days ago, with each day in its separate column. Today's results are represented by `_count`.

<img src={useBaseUrl('img/search/timecompare/Count-2d.png')} alt="Count 2d" style={{border: '1px solid gray'}} width="400" />

Create a line chart to visualize the results.

<img src={useBaseUrl('img/search/timecompare/count-2dLineChart.png')} alt="Count 2d line chart" style={{border: '1px solid gray'}} width="800" />

Using the multiple comparison feature, you can compare the number of logs against every ten minutes of the past hour:

```sumo
_sourceHost = prod
| timeslice by 1m
| count by _timeslice
| compare timeshift 10m 5
```

Each ten-minute period produces its own column in the output table:

<img src={useBaseUrl('img/search/timecompare/tenminute.png')} alt="Ten minute" style={{border: '1px solid gray'}} width="800" />

Create a line chart to visualize the results.  

<img src={useBaseUrl('img/search/timecompare/TenMinuteLIneChart.png')} alt="Ten minute line chart" style={{border: '1px solid gray'}} width="800" />

Alternatively, you can compare against the average of all the ten minute periods:

```sumo
_sourceHost = prod
| timeslice by 1m
| count by _timeslice
| compare timeshift 10m 5 avg
```

<img src={useBaseUrl('img/search/timecompare/TenMinAvg.png')} alt="Ten min avg" style={{border: '1px solid gray'}} width="500" />

Create a line chart to visualize the results.  

<img src={useBaseUrl('img/search/timecompare/TenMinAvgLineChart.png')} alt="Ten min avg line chart" style={{border: '1px solid gray'}} width="800" />

### Compare categorical data parsed from logs

Use compare to analyze the change in delays on different `_sourceHost`s using parsed data from logs.

```sumo
"delay:"
| parse "delay: *" as delay
| avg(delay) as average_delay_in_millis by _sourceHost
| compare timeshift 30m
```

This example computes the average delay per `_sourceHost`, and compares with results from 30 minutes ago.

<img src={useBaseUrl('img/search/timecompare/DelayAvg.png')} alt="Delay avg" style={{border: '1px solid gray'}} width="500" />

These results would create a line chart such as the following.

<img src={useBaseUrl('img/search/timecompare/DelayLineChart.png')} alt="Delay line chart" style={{border: '1px solid gray'}} width="800" />

### Compare after a Transpose operation

You can use the `compare` operator after a `transpose` operation, such as the following:

```sumo
_sourceCategory=analytics
| timeslice 1m
| count by _timeslice, _sourceHost
| transpose row _timeslice column _sourceHost as %"nite-analytics-1", %"nite-analytics-2"
| compare with timeshift 15m
```