FuseQL Compare Operators

The compare operator enables you to analyze data across different time periods by comparing current aggregated metrics with historical values. This is useful for identifying trends, detecting anomalies, and understanding how metrics change over time.

compare timeshift

Compare current aggregated data with time-shifted historical data.

The compare operator can only be used after an aggregation operator (such as count, sum, avg, etc.). It requires aggregated data to perform time-based comparisons.
Syntax
| compare timeshift <duration> (1)

| compare timeshift <duration> <count> (2)

| compare timeshift <duration> as <alias> (3)

| compare timeshift <duration> as <alias>, timeshift <duration2> as <alias2> (4)
none
1 duration: Required. The time duration to shift back. Supported units: m (minutes), h (hours), d (days), w (weeks).
2 count: Optional. Number of time periods to compare. Creates multiple columns, one for each period. Default is 1.
3 alias: Optional. Custom name for the comparison column(s). If not specified, uses format <metric>_<duration>_<index>.
4 Multiple timeshifts can be specified, separated by commas, each with its own duration and optional alias.
Behavior

  • Creates new columns in the result set containing the time-shifted values

  • Matches rows based on group keys (excluding time keys like _timeslice)

  • Returns NULL for time-shifted values when no matching historical data exists

  • When _timeslice is present, normalizes time values to align with the baseline period

Column Naming

The operator generates column names based on the following rules:

  • With alias: <metric>_<alias> (e.g., count_yesterday)

  • Without alias: <metric>_<duration>_<index> (e.g., count_1d_1, count_7d_2)

  • Multiple same alias: <metric>_<alias>_<index> (e.g., count_yesterday_1, count_yesterday_2)

Examples
Compare current day with yesterday
* | timeslice 1h | count by (_timeslice) | compare timeshift 1d
none

This query creates a column count_1d_1 containing the count from 24 hours ago for each time slice.

Compare with multiple previous days
* | timeslice 1h | count by (_timeslice) | compare timeshift 1d 7
none

This creates 7 columns (count_1d_1 through count_7d_7), each containing data from 1, 2, 3…​ up to 7 days ago.

Compare with custom aliases
* | timeslice 1h | count by (_timeslice) | compare timeshift 1d as yesterday, timeshift 1w as last_week
none

Creates columns count_yesterday and count_last_week for easy identification.

Compare service metrics by region
source="api" | timeslice 1h | count by (_timeslice, service, region) | compare timeshift 1d
none

Compares current metrics with yesterday’s data, grouped by service and region.

Compare average response time
* | timeslice 1h | avg(@duration:number) by (_timeslice) | compare timeshift 1d as yesterday, timeshift 1w as last_week
none

Compares average response times with both yesterday and last week.

Common Use Cases

  • Day-over-day comparison: Compare today’s metrics with yesterday using timeshift 1d

  • Week-over-week comparison: Compare this week with last week using timeshift 1w

  • Trend analysis: Use multiple timeshifts to see how metrics evolve over time

  • Anomaly detection: Identify unusual patterns by comparing current values with historical averages

  • Seasonal analysis: Compare metrics across different time periods to identify seasonal patterns