How to display Differential data

[nakar-kashi]

【Prerequisites】
・There are hundreds of servers
・The disk size for each server has already been acquired

【What i want to realize】
・Get the disk size difference between the previous day and the current day
・Display top10 of servers with large (increased) differences among acquired differences

【environment】
KIBANA:Version: 6.6.1

Perhaps it is necessary to realize timelion, but I can not find a valid writing method

[nickpeihl]

Hi @nakar-kashi. Perhaps you can do this with bucket script aggregations in TSVB. Here's an example screenshot where I've calculated the minimum and maximum value of a field then subtracted to get the difference.

[nakar-kashi]

Hi,@nickpeihl.

Thank you for answering.
Sorry for the missing information.I can get the difference with your answer.

The disk size is taken once every day for each server, and I want to obtain the difference from the previous day on the same server
Therefore, it is necessary to access the data one day ago.
I think that timeshift is necessary for realization, but can it be realized with Bucket Script?
Furthermore, I want to display top10 with a large difference in disk size

for example(For top3 display)

Octorber 1
serverA:100GB
serverB:200GB
serverC:150GB
serverD:300GB
serverE:400GB
serverF:320GB
serverG:800GB

Octorber 2
serverA:180GB
serverB:210GB
serverC:110GB
serverD:390GB
serverE:600GB
serverF:320GB
serverG:650GB

DISPLAY
ServerE 200GB
ServerD:90GB
ServerA:80GB