topic Re: Compare One Field over Two Times in Splunk Search

Compare One Field over Two Times

craigmueller — Mon, 13 Jul 2015 17:27:39 GMT

I want to see what is new for the past two weeks, that hasn't been seen in the past. The only part of the search that would change is the time frame.

earlist=-4w latest=-2w index=int sourcetype=threat | stats count by name | sort -count| head 10
Gives me a table of top ten names between two and four weeks ago.
The name field updates on a weekly basis, sometimes more often. Nothing from the name field would be deleted.

I'm looking to compare the top 10 results and a complete list of what is new in the past two weeks.

I have searched through other answers, but not having any luck getting a working search.

Thank you

Re: Compare One Field over Two Times

woodcock — Mon, 13 Jul 2015 19:25:27 GMT

I don't understand your question so do go back around and spell it out more clearly. Sample data would help.

Re: Compare One Field over Two Times

craigmueller — Mon, 13 Jul 2015 19:54:51 GMT

Let's say I run this search, earliest=-4w latest=-2w index=int sourcetype=threat | stats count by name | sort -count | head 10
Results are -
Endpoint 6434272
URL 2499463
RPC 2428255
HTTP 299502
Login 180736
enumeration 170613
SMB 167128
NetBIOS 165573
user 92934
Buffer 54541

I run the same search, just with the earlier time frame, earliest=-2w latest=-d index=int sourcetype=threat | stats count by name | sort -count | head 10
Results are -
Endpoint 7449314
SMB 2699952
URL 2489496
enumeration 503045
Options 332335
MP4 295500
Adobe 243639
NetBIOS 178598
Microsoft 139980
SIP 39992

You can see there is some overlap between the two searches and that is was I am wanting to omit. I am only wanting to see what is new when comparing the past two weeks vs an older time frame.

Re: Compare One Field over Two Times

sk314 — Mon, 13 Jul 2015 20:08:16 GMT

This might work:

Re: Compare One Field over Two Times

woodcock — Mon, 13 Jul 2015 23:29:04 GMT

Based on your clarification, maybe like this:

earlist=-4w latest=-2w index=int sourcetype=threat | stats count by name | sort -count| head 10 | eval type=older | append [earlist=-2w latest=-d index=int sourcetype=threat | stats count by name | sort -count| head 10 | eval type=newer] | eventstats dc(type) as numTypes by name | where numTypes=1 and type="newer"