topic Re: Compare results from two timeframes and show differences? in Alerting

Compare results from two timeframes and show differences?

mistydennis — Tue, 14 Feb 2023 22:22:53 GMT

Hello Splunk experts - I am trying to create a query that shows the difference in results from two distinct time frames.

Original search:

What I need to do is add two timeframes: results from 30 days ago vs. results from today, and then show the difference in events between those two timeframes.

Re: Compare results from two timeframes and show differences?

bowesmana — Tue, 14 Feb 2023 22:35:10 GMT

Use 2 data set ranges. I am not sure what the idea is behind mvcombine and then splitting and counting, but does this start to work for you?

index=summary_nexpose (earliest=@d latest=now) OR (earliest=-30d@d latest=-29d@d) | bin _time span=1d | stats count(cveID) as "Number of CVEs" values(cveID) by _time AssetName, Exposure

Not sure what you want to do with your comparison. logic

What do you want to see from a comparison - a table form or chart or...?

Do you want the two dates combined to both values on the same row?

Re: Compare results from two timeframes and show differences?

mistydennis — Tue, 14 Feb 2023 22:41:50 GMT

So that query gives me all the results from both days (2,584 rows). What I want to find out is how the results are different from both days. With my data set there should be 136 rows.

The desired outcome is a table that looks like this:

AssetName	cveID	Exposure	Number of CVEs
server1	cve1	Internal	1
server 2	cve1, cve2, cve3	Internal	3

Re: Compare results from two timeframes and show differences?

bowesmana — Tue, 14 Feb 2023 23:43:29 GMT

So, Asset count * Exposure types = 68?

Not sure how you get 2584 rows from that stats command.

Anyway, so in your example, does the server1 row indicate that today has 1 CVE and 30 days ago there were none? How do you want to reflect 'difference'.

You can try something like this