https://community.splunk.com/t5/Getting-Data-In/Compare-data-for-1-hour/m-p/536946#M90003 <P>I am currently running a search which provides Name of host which are unregistered at a particular time and then after 1 hour run same search to fetch unregistered host</P><P>Then I manually compare 2 reports for name of host were unregistered in first report and now changed to registered in next report.&nbsp;</P><P>Based on the data compared for unregistered an registered host I take necessary action on unregistered host..&nbsp;</P><P>My question--is there a way we can compare the data for 1 hour in 1 single search??</P><P>Query currently use is - -</P><P>| input lookup R2VirtualDedktopAssignments | where Environment=PROD And Registrations tate =Unregistered</P> Sun, 24 Jan 2021 06:05:57 GMT priya0709 2021-01-24T06:05:57Z https://community.splunk.com/t5/Getting-Data-In/Compare-data-for-1-hour/m-p/536946#M90003 <P>I am currently running a search which provides Name of host which are unregistered at a particular time and then after 1 hour run same search to fetch unregistered host</P><P>Then I manually compare 2 reports for name of host were unregistered in first report and now changed to registered in next report.&nbsp;</P><P>Based on the data compared for unregistered an registered host I take necessary action on unregistered host..&nbsp;</P><P>My question--is there a way we can compare the data for 1 hour in 1 single search??</P><P>Query currently use is - -</P><P>| input lookup R2VirtualDedktopAssignments | where Environment=PROD And Registrations tate =Unregistered</P> Sun, 24 Jan 2021 06:05:57 GMT https://community.splunk.com/t5/Getting-Data-In/Compare-data-for-1-hour/m-p/536946#M90003 priya0709 2021-01-24T06:05:57Z