https://community.splunk.com/t5/Splunk-Search/How-to-compare-assets-from-previous-week-and-highlight-the/m-p/644452#M223200 <P>Hello</P> <P>I have created a dashboard that shows the previous 4 days and the equivalent days the week before for asset counts, for example IPS devices reporting in. Some days i will have 15 devices reporting in, but the previous week may have 18, so im looking for a way to show what the missing devices are? is there a way to just pull out the devices that are missing?</P> <P>&nbsp;</P> <P>Cheers</P> Wed, 24 May 2023 13:43:50 GMT supersnedz 2023-05-24T13:43:50Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-assets-from-previous-week-and-highlight-the/m-p/644452#M223200 <P>Hello</P> <P>I have created a dashboard that shows the previous 4 days and the equivalent days the week before for asset counts, for example IPS devices reporting in. Some days i will have 15 devices reporting in, but the previous week may have 18, so im looking for a way to show what the missing devices are? is there a way to just pull out the devices that are missing?</P> <P>&nbsp;</P> <P>Cheers</P> Wed, 24 May 2023 13:43:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-assets-from-previous-week-and-highlight-the/m-p/644452#M223200 supersnedz 2023-05-24T13:43:50Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-assets-from-previous-week-and-highlight-the/m-p/644457#M223201 <P>Count by device and day of the week, then those with count of 1 appear in either one week of the other but not both.</P><P>A slightly more sophisticated way to do this is assign 1 to those events in this week and 2 to those events in the previous weeks, then sum these values by device. Those with a sum of 3 are in both weeks, those with a sum of 2 are in the previous week only, and those with a sum of 1 are only in this week.</P> Wed, 24 May 2023 10:35:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-assets-from-previous-week-and-highlight-the/m-p/644457#M223201 ITWhisperer 2023-05-24T10:35:16Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-assets-from-previous-week-and-highlight-the/m-p/644713#M223260 <P>my current query for grabbing the total counts by day is:<BR />index="siem-ips" cim_entity_zone="UK" | timechart dc(an) | rename dc(an) as IPS | timewrap 4d | rename IPS_4days_before as "IPS Previous Week" | rename IPS_latest_4days as "IPS Latest"<BR />This shows a count of the previous 4 days, and then the 3 days the week before. I tried just adding a stats count on the end but it didnt load any data. I'm a bit stuck. Essentially just need to see what isnt reporting in that was previously</P> Fri, 26 May 2023 09:02:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-assets-from-previous-week-and-highlight-the/m-p/644713#M223260 supersnedz 2023-05-26T09:02:16Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-assets-from-previous-week-and-highlight-the/m-p/644718#M223263 <P>Your timewrap should be 1w not 4d as you want the same days in the previous week</P> Fri, 26 May 2023 09:29:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-assets-from-previous-week-and-highlight-the/m-p/644718#M223263 ITWhisperer 2023-05-26T09:29:11Z