How do I measure drift in a resource over time?

Using the timeshift OPAL verb, you can calculate the deltas between counts of resources for use in anomaly detection.

Here’s an example of making a metric from a resource and comparing week-over-week values:

@yesterday <- @"Server/Host" {
    timeshift -1d
    make_col period:"yesterday"
    timechart options(empty_bins:true), yesterday_Host_count_distinct_exact:count_distinct_exact(host), group_by(period)
    topk 100
}

make_col period:"today"
timechart options(empty_bins:true), today_Host_count_distinct_exact:count_distinct_exact(host), group_by(period)
topk 100

union @yesterday
statsby value:any_not_null(case(period="today", today_Host_count_distinct_exact, period="yesterday", yesterday_Host_count_distinct_exact)), group_by(period)
pivot 
    period,
    value,
    value_today:"today",
    value_yesterday:"yesterday",
    group_by()
make_col delta:if_null((100 * value_today / (value_today - value_yesterday)),0)

Use a two-day period and a single stat visualization.