topic Re: compare results in different days in Splunk Search

compare results in different days

stevesmith08 — Wed, 30 Sep 2020 00:41:15 GMT

Good day! I have two requests for different dates. I need to compare the results of the queries.

The following comparison command works correctly:
| set diff
[search sourcetype=“scan_results” date=“2019-05-27” | table host, port, state]
[search sourcetype=“scan_results” date=“2019-05-28” | table host, port, state]

But I need to add a field “date” to each result.

In the end, I want to track changes in the status of ports for different scan dates.

Could you help me, please?

Thanks

Re: compare results in different days

koshyk — Tue, 28 May 2019 07:19:30 GMT

hi Steve
You already have got the "date" field in the event. You could add it straight away or am i not understanding the issue correctly?

| set diff
[search sourcetype=“scan_results” date=“2019-05-27” | table host, port, state, date]
[search sourcetype=“scan_results” date=“2019-05-28” | table host, port, state, date]

Re: compare results in different days

DavidHourani — Tue, 28 May 2019 07:22:02 GMT

Hi @stevesmith08,

You can use something like that if you want to add the date field :

sourcetype=“scan_results” date=“2019-05-27”  OR date=“2019-05-28”  
| stats dc(date) as condition values(date) as date by host, port, state 
| where condition <2

Cheers,
David

Re: compare results in different days

stevesmith08 — Tue, 28 May 2019 07:24:19 GMT

If you explicitly specify the date in each subquery, the results they return differ in this field.

I need to compare only fields “host”, “port”, “state”

Re: compare results in different days

stevesmith08 — Tue, 28 May 2019 07:27:36 GMT

Thanks! it works correctly

Re: compare results in different days

DavidHourani — Tue, 28 May 2019 07:30:03 GMT

you're welcome !