https://community.splunk.com/t5/Splunk-Search/Comparing-two-time-frames-with-the-same-search/m-p/630021#M218868 <P>First of all, be careful with the word "event" when talking about Splunk search because if you use tstats, you cannot retrieve what Splunk defines as an "event". &nbsp;So, I assume that your events carries an identifying field, say "eventID", and that you want to find which eventID's exist in the 90-day search but not in the 30-day search. Is this correct?</P><P>For this, you can do something like</P><LI-CODE lang="markup">| tstats count where earliest=-30d by eventID | eval thisis = "30day" | append [| tstats count where earliest=-90d by eventID | eval thisis = "90day"] | stats values(thisis) as thisis by eventID | where mvcount(thisis) == 1 AND thisis == "90day"</LI-CODE><P>Hope this helps.</P> Wed, 08 Feb 2023 07:32:48 GMT yuanliu 2023-02-08T07:32:48Z https://community.splunk.com/t5/Splunk-Search/Comparing-two-time-frames-with-the-same-search/m-p/629988#M218857 <P>So I have a search I run for an alert which looks for a missing event, it's a simple tstats that shows stuff within the last 30 days I would like to compare the 90 days variant in the same search and determine the missing events.&nbsp;</P> <P>&nbsp;</P> <P>Any ideas?&nbsp;</P> Wed, 08 Feb 2023 16:44:55 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-two-time-frames-with-the-same-search/m-p/629988#M218857 Orangebottle76 2023-02-08T16:44:55Z https://community.splunk.com/t5/Splunk-Search/Comparing-two-time-frames-with-the-same-search/m-p/630021#M218868 <P>First of all, be careful with the word "event" when talking about Splunk search because if you use tstats, you cannot retrieve what Splunk defines as an "event". &nbsp;So, I assume that your events carries an identifying field, say "eventID", and that you want to find which eventID's exist in the 90-day search but not in the 30-day search. Is this correct?</P><P>For this, you can do something like</P><LI-CODE lang="markup">| tstats count where earliest=-30d by eventID | eval thisis = "30day" | append [| tstats count where earliest=-90d by eventID | eval thisis = "90day"] | stats values(thisis) as thisis by eventID | where mvcount(thisis) == 1 AND thisis == "90day"</LI-CODE><P>Hope this helps.</P> Wed, 08 Feb 2023 07:32:48 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-two-time-frames-with-the-same-search/m-p/630021#M218868 yuanliu 2023-02-08T07:32:48Z https://community.splunk.com/t5/Splunk-Search/Comparing-two-time-frames-with-the-same-search/m-p/630035#M218871 <P>Hi,</P><P>thanks for the reply! I am doing it for hosts to see which are missing.</P> Wed, 08 Feb 2023 08:26:42 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-two-time-frames-with-the-same-search/m-p/630035#M218871 Orangebottle76 2023-02-08T08:26:42Z https://community.splunk.com/t5/Splunk-Search/Comparing-two-time-frames-with-the-same-search/m-p/630057#M218873 <P>In that case, host field is "eventID"</P> Wed, 08 Feb 2023 09:33:51 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-two-time-frames-with-the-same-search/m-p/630057#M218873 yuanliu 2023-02-08T09:33:51Z