https://community.splunk.com/t5/Splunk-Search/How-to-compare-the-hourly-count-of-events-for-a-particular-event/m-p/598813#M208507 <LI-CODE lang="markup">| bin _time span=1h | stats dc(_time) as hours min(_time) as _time by id | where hours = 1 | stats values(id) as ids by _time</LI-CODE><P>Ids in the earlier hour are missing from the later hour and ids in the later hour are new to the later hour.</P> Sun, 22 May 2022 18:59:09 GMT ITWhisperer 2022-05-22T18:59:09Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-the-hourly-count-of-events-for-a-particular-event/m-p/598778#M208499 <P>I am trying to&nbsp; create a search&nbsp; which will give the difference in count for a field called "id" and show what are those different values for that field "id".</P> <P>For instance if the current hour count for id is 900 and previous hour count is 830 ...I want to see the difference as 70 and show what are those 70 different id's .Currently I am able to get the difference using below search</P> <P>index="netbox_test"<BR />| rename "results{}.id" as "id"<BR />| timechart span=1h count(id) as total<BR />| delta total as difference</P> <P>&nbsp;</P> <P>Thanks in Advance</P> Sun, 22 May 2022 19:26:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-the-hourly-count-of-events-for-a-particular-event/m-p/598778#M208499 vrmandadi 2022-05-22T19:26:47Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-the-hourly-count-of-events-for-a-particular-event/m-p/598780#M208500 <P>If the difference in id count between two hour-long periods is 70 doesn't mean that it's only 70 ids that differ. Example - in one hour you have ids of 1,2,3 in next - 4,5. The count difference is 1 but all the ids are different.</P><P>Either you're assuming too much or there are additional unmentioned conditions.</P> Sun, 22 May 2022 06:12:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-the-hourly-count-of-events-for-a-particular-event/m-p/598780#M208500 PickleRick 2022-05-22T06:12:13Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-the-hourly-count-of-events-for-a-particular-event/m-p/598787#M208502 <P>To be more clear I am pulling netbox data into Splunk...so there are 900 devices in netbox...sometimes these 900 devices might be turned off or removed or added...So when these changes occur the count differs...I want to see what is the difference when compared hourly...I&nbsp; was able to find the difference every hour by using the delta..but I want to know what are those different devices for that particular hour..like comparing current hour with previous hour and show the count difference and what is different.</P><P>&nbsp;</P><P>Example:</P><P>Previous Hour:&nbsp; 1 , 2 ,3</P><P>Current Hour : 2,3,4,5,6</P><P>Difference Count :2</P><P>ID's different : 1,4,5,6</P> Sun, 22 May 2022 14:33:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-the-hourly-count-of-events-for-a-particular-event/m-p/598787#M208502 vrmandadi 2022-05-22T14:33:04Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-the-hourly-count-of-events-for-a-particular-event/m-p/598803#M208505 <P>So you see for yourself that simply counting is not a reliable way of noticing that the sets are different. If you had 1,2,3,4 during one hour and 3,4,6,9 next hour, you'd miss that 1,2 turned into 6,9.</P> Sun, 22 May 2022 16:34:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-the-hourly-count-of-events-for-a-particular-event/m-p/598803#M208505 PickleRick 2022-05-22T16:34:22Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-the-hourly-count-of-events-for-a-particular-event/m-p/598813#M208507 <LI-CODE lang="markup">| bin _time span=1h | stats dc(_time) as hours min(_time) as _time by id | where hours = 1 | stats values(id) as ids by _time</LI-CODE><P>Ids in the earlier hour are missing from the later hour and ids in the later hour are new to the later hour.</P> Sun, 22 May 2022 18:59:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-the-hourly-count-of-events-for-a-particular-event/m-p/598813#M208507 ITWhisperer 2022-05-22T18:59:09Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-the-hourly-count-of-events-for-a-particular-event/m-p/598942#M208527 <P>Thank You ...Let me check this and get back to you</P> Mon, 23 May 2022 17:06:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-the-hourly-count-of-events-for-a-particular-event/m-p/598942#M208527 vrmandadi 2022-05-23T17:06:52Z