Problem with the diff command

ysdeos — Sun, 19 Feb 2012 04:51:43 GMT

Hi!

Every time a user enters my system, I report his userId.
I tried using the DIFF operation to find out which userIds entered my system in the past 7 days but didn't enter in the past 3 days.

I used the following query:

| set diff [search userId earliest=-7d | fields userId] [search userId earliest=-3d | fields userId] | stats count by userId

This didn't work. It seems like Splunk ignored my request to search for the last 7 days of reports and actually queried this:

| set diff [search userId earliest=-1d | fields userId] [search userId earliest=-1d | fields userId] | stats count by userId

I came to this conclusion by doing the following:

| set diff [search userId earliest=-1d | fields userId] [search userId earliest=-0d | fields userId] | stats count by userId

(returned 0 results)

and compared it with:

| set diff [search userId earliest=-7d | fields userId] [search userId earliest=-0d | fields userId] | stats count by userId

(returned 1000 results)
and

userId earliest=-7d | stats count by userId

(returned 1000 results)

Thank you!

Re: Problem with the diff command

Drainy — Sun, 19 Feb 2012 10:57:55 GMT

Using set diff will return the results that are not common to both subsearches. You are searching over all 7 days in your first subsearch and then the last three days, this will create an overlap (so the results will be the same).

What happens if you also set the latest too?
Something like;

| set diff [search userId earliest=-7d@d latest=-4d@d | fields userId] [search userId earliest=-3d@d | fields userId] | stats count by userId

I'm not able to test this so sorry if its not quite right, just going off the docs. Also my times may be slightly out of sync, too early in the morning for thinking 🙂

topic Problem with the diff command in Splunk Search

Problem with the diff command

Re: Problem with the diff command