https://community.splunk.com/t5/Splunk-Search/how-to-show-added-and-deleted-in-set-diff/m-p/263336#M189802 <P>I am using | set diff to find the names that have been changed yesterday compared to a week using the search as below</P> <P>What i am trying to get is to show the ones that have been added and dropped in search it currently gives all together as one list.</P> <P><EM>| set diff [ search index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value &gt;= 0.000 earliest=-1d@d latest=@m | stats count by name | table name ]<BR /><BR /> [ search index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value &gt;= 0.000 earliest=-7d@d latest=-1d@d | stats count by name | table name ]</EM></P> Tue, 29 Sep 2020 07:30:03 GMT vinay4444 2020-09-29T07:30:03Z https://community.splunk.com/t5/Splunk-Search/how-to-show-added-and-deleted-in-set-diff/m-p/263336#M189802 <P>I am using | set diff to find the names that have been changed yesterday compared to a week using the search as below</P> <P>What i am trying to get is to show the ones that have been added and dropped in search it currently gives all together as one list.</P> <P><EM>| set diff [ search index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value &gt;= 0.000 earliest=-1d@d latest=@m | stats count by name | table name ]<BR /><BR /> [ search index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value &gt;= 0.000 earliest=-7d@d latest=-1d@d | stats count by name | table name ]</EM></P> Tue, 29 Sep 2020 07:30:03 GMT https://community.splunk.com/t5/Splunk-Search/how-to-show-added-and-deleted-in-set-diff/m-p/263336#M189802 vinay4444 2020-09-29T07:30:03Z https://community.splunk.com/t5/Splunk-Search/how-to-show-added-and-deleted-in-set-diff/m-p/263337#M189803 <P>Unfortunately, there is no such option in <CODE>| set</CODE> command, but you can achieve the same using an append-stats combination, like this</P> <PRE><CODE>index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value &gt;= 0.000 earliest=-1d@d latest=@m | stats count by name | table name | eval Action="Today" | append [ search index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value &gt;= 0.000 earliest=-7d@d latest=-1d@d | stats count by name | table name | Action="Last7Days" ] | stats values(*) by name | where mvcount(Action)=1 | replace "Today" with "Added" "Last7Days" with "Deleted" in Action </CODE></PRE> Fri, 09 Oct 2015 21:16:10 GMT https://community.splunk.com/t5/Splunk-Search/how-to-show-added-and-deleted-in-set-diff/m-p/263337#M189803 somesoni2 2015-10-09T21:16:10Z