# Calculate two streams (as sets) difference

**URL:** <https://community.influxdata.com/t/calculate-two-streams-as-sets-difference/6376>\
**Category:** Kapacitor\
**Tags:** kapacitor\
**Created:** [August 27, 2018, 9:00am UTC](https://community.influxdata.com/t/calculate-two-streams-as-sets-difference/6376 "2018-08-27T09:00:04Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![stanislav-zaprudskiy](https://avatars.discourse-cdn.com/v4/letter/s/f17d59/32.png) [@stanislav-zaprudskiy](https://community.influxdata.com/u/stanislav-zaprudskiy)\
**Post date:** [August 27, 2018, 9:00am UTC](https://community.influxdata.com/t/calculate-two-streams-as-sets-difference/6376/1 "2018-08-27T09:00:04Z")

</div>

In my rule I’m alerting on a stream if count of points in it decreased (where each point stands for an alive server along with its metadata). I do this by having 2 similar streams + window nodes, where for the second stream its window is extended and contains two periods of data:

```auto
var data = stream
    |from()
        .measurement(measurement)

var current_period_agents = data
    |window()
        .period(window_period)
        .every(window_every)
        .align()

var current_period_agents_count = current_period_agents
    |count('status_code')

var extended_period_agents = data
    |window()
        .period(extended_window_period)
        .every(window_every)
        .align()

var extended_period_agents_count = extended_period_agents
    |count('status_code')

var stats = extended_period_agents_count
    |join(current_period_agents_count)
        .as('extended_period', 'current_period')
    |eval(lambda: "extended_period.count" - "current_period.count")
        .as('previous_period.count')
        .keep()
    |eval(lambda: "previous_period.count" - "current_period.count")
        .as('current_period.count_delta')
        .keep()
|alert()
    .crit(lambda: "current_period.count_delta" > 0)

```

This way I can detect the decrease event. But what I additionally want, is to include the details of that decrease - what exactly has disappeared in the current data. For that I’d need to calculate a difference between two sets:

- first the diff `past_period_agents = extended_period_agents - current_period_agents` - to get bare data for the past period
- second the diff `past_period_agents - current_period_agents` omitting the data’s timestamps - to find the data which was in the past period, but has gone in the current period.

Having such alert details would simplify any further human analysis and processing of an alert. But I’ve no idea how to achieve that, also considering some previously submitted question - [Reference other node's data in alert() details of the current node](https://community.influxdata.com/t/reference-other-nodes-data-in-alert-details-of-the-current-node/6360).

Any suggestions would be highly appreciated. Thanks!