topic Re: How to find differences of a field's values between time ranges? in Splunk Search

How to find differences of a field's values between time ranges?

davespatz — Mon, 28 Sep 2020 17:18:31 GMT

Hello,

Long story on why but I need to run a report on some squid logs based on the host name of the URL visited by the client through the squid proxy (field is url_host). I need to see any new url_host entries since a certain time period to see what changed since my last report - essentially, get me a list of new url_host's I didn't see the last time or time before that, etc. My search is below but it doesn't seem to negate the url_host field values of the inner search. The inner search is what I want to negate and anything new, give me stats on the url_host by count.

Tried two different ways - first way below returns items that are still in the inner search:

sourcetype=squid earliest="7/17/2014:00:00:00" latest=now NOT [ search sourcetype=squid earliest="6/18/2014:00:00:00" latest="7/16/2014:23:59:59" | fields url_host ] | fields url_host | stats count by url_host

Second way also appears to give me results that I know are in both searches:

| set diff [search sourcetype=squid earliest="7/17/2014:00:00:00" latest=now | fields url_host] [search sourcetype=squid earliest="6/18/2014:00:00:00" latest="7/16/2014:23:59:59" | fields url_host] | stats count by url_host

Thanks in advance to anyone who answers.

Re: How to find differences of a field's values between time ranges?

somesoni2 — Mon, 11 Aug 2014 17:31:39 GMT

Try this

sourcetype=squid earliest="7/17/2014:00:00:00" latest=now 
| stats count by url_host | eval Period="current"
| append [ search sourcetype=squid earliest="6/18/2014:00:00:00" latest="7/16/2014:23:59:59"  | stats count by url_host | eval Period="past" ]
| stats values(Period) as Periods by url_host | where mvcount(Periods)=1 AND Periods="current"

Re: How to find differences of a field's values between time ranges?

davespatz — Thu, 14 Aug 2014 02:51:30 GMT

Hey thanks for the really quick answer. I learned more about different commands with that but unfortunately it still shows results from the previous time period. I just assumed Splunk could do this easily so how - there's ALWAYS a way to do it with Splunk but this may just be easier for me to knock it out in Excel.