FuseQL Compare Operators :: Kloudfuse Docs

FuseQL Compare Operators

The compare operator enables you to analyze data across different time periods by comparing current aggregated metrics with historical values. This is useful for identifying trends, detecting anomalies, and understanding how metrics change over time.

compare timeshift

Compare current aggregated data with time-shifted historical data.


	The `compare` operator can only be used after an aggregation operator (such as `count`, `sum`, `avg`, etc.). It requires aggregated data to perform time-based comparisons.

Syntax

| compare timeshift <duration> (1)

| compare timeshift <duration> <count> (2)

| compare timeshift <duration> as <alias> (3)

| compare timeshift <duration> as <alias>, timeshift <duration2> as <alias2> (4)


1	`duration`: Required. The time duration to shift back. Supported units: `m` (minutes), `h` (hours), `d` (days), `w` (weeks).
2	`count`: Optional. Number of time periods to compare. Creates multiple columns, one for each period. Default is `1`.
3	`alias`: Optional. Custom name for the comparison column(s). If not specified, uses format `<metric>_<duration>_<index>`.
4	Multiple timeshifts can be specified, separated by commas, each with its own duration and optional alias.

Behavior

Creates new columns in the result set containing the time-shifted values
Matches rows based on group keys (excluding time keys like _timeslice)
Returns NULL for time-shifted values when no matching historical data exists
When _timeslice is present, normalizes time values to align with the baseline period

Column Naming

The operator generates column names based on the following rules:

With alias: <metric>_<alias> (e.g., count_yesterday)
Without alias: <metric>_<duration>_<index> (e.g., count_1d_1, count_7d_2)
Multiple same alias: <metric>_<alias>_<index> (e.g., count_yesterday_1, count_yesterday_2)

Examples

Compare current day with yesterday

* | timeslice 1h | count by (_timeslice) | compare timeshift 1d

This query creates a column count_1d_1 containing the count from 24 hours ago for each time slice.

Compare with multiple previous days

* | timeslice 1h | count by (_timeslice) | compare timeshift 1d 7

This creates 7 columns (count_1d_1 through count_7d_7), each containing data from 1, 2, 3… up to 7 days ago.

Compare with custom aliases

* | timeslice 1h | count by (_timeslice) | compare timeshift 1d as yesterday, timeshift 1w as last_week

Creates columns count_yesterday and count_last_week for easy identification.

Compare service metrics by region

source="api" | timeslice 1h | count by (_timeslice, service, region) | compare timeshift 1d

Compares current metrics with yesterday’s data, grouped by service and region.

Compare average response time

* | timeslice 1h | avg(@duration:number) by (_timeslice) | compare timeshift 1d as yesterday, timeshift 1w as last_week

Compares average response times with both yesterday and last week.

Common Use Cases

Day-over-day comparison: Compare today’s metrics with yesterday using timeshift 1d
Week-over-week comparison: Compare this week with last week using timeshift 1w
Trend analysis: Use multiple timeshifts to see how metrics evolve over time
Anomaly detection: Identify unusual patterns by comparing current values with historical averages
Seasonal analysis: Compare metrics across different time periods to identify seasonal patterns