https://community.splunk.com/t5/Splunk-Search/Streamstats-Question/m-p/307138#M92100 <P>you can use earliest(_time) and latest(_time) for each host, all hosts with earliest as today are new added servers and server with latest as yesterday are removed today.</P> Tue, 29 Sep 2020 16:10:55 GMT kyaparla 2020-09-29T16:10:55Z https://community.splunk.com/t5/Splunk-Search/Streamstats-Question/m-p/307137#M92099 <P>Using this query below could you help me identify servers that were added on a daily basis? example today is friday 13th i would like to see new servers that were not on the report on the Thursday the 12th. Alternatively I would like to see servers that were removed.</P> <P>query - index=#### sourcetype=#### Name="####*"|table Name _time OS LastScanDate|eval Days=round((relative_time(now(),"@d")-relative_time(LastScanDate,"@d"))/86400,0)|eval LastScanDate=strftime(LastScanDate, "%Y-%m-%d")|sort by Name _time|streamstats window=1 current=f global=f values(LastScanDate) as prev|eval John=strftime(LastScanDate, "%d")</P> <P>Example</P> <PRE><CODE>Name _time OS LastScanDate Days prev Sever 1 2017-10-06T23:45:48.840-0500 Windows Server 2016 9/12/2017 31 ####WCAPPW1601 2017-10-07T23:45:15.257-0500 Windows Server 2016 9/12/2017 31 9/12/2017 ####WCAPPW1601 2017-10-08T23:45:53.773-0500 Windows Server 2016 9/12/2017 31 9/12/2017 ####WCAPPW1601 2017-10-08T23:50:59.393-0500 Windows Server 2016 9/12/2017 31 9/12/2017 ####WCAPPW1601 2017-10-09T23:45:11.293-0500 Windows Server 2016 9/12/2017 31 9/12/2017 ####WCAPPW1601 2017-10-10T23:45:15.580-0500 Windows Server 2016 9/12/2017 31 9/12/2017 ####WCAPPW1601 2017-10-11T23:45:37.297-0500 Windows Server 2016 9/12/2017 31 9/12/2017 ####WCAPPW1601 2017-10-12T23:45:55.467-0500 Windows Server 2016 9/12/2017 31 9/12/2017 ####WDAPPBSO06B 2017-10-06T23:45:48.840-0500 Windows Server 2012 R2 9/14/2017 29 9/12/2017 ####WDAPPBSO06B 2017-10-07T23:45:15.257-0500 Windows Server 2012 R2 9/14/2017 29 9/14/2017 ####WDAPPBSO06B 2017-10-08T23:45:53.773-0500 Windows Server 2012 R2 9/14/2017 29 9/14/2017 ####WDAPPBSO06B 2017-10-08T23:50:59.393-0500 Windows Server 2012 R2 9/14/2017 29 9/14/2017 ####WDAPPBSO06B 2017-10-09T23:45:11.293-0500 Windows Server 2012 R2 9/14/2017 29 9/14/2017 ####WDAPPServer02A 2017-10-06T23:45:48.840-0500 Windows Server 2012 R2 9/19/2017 24 9/14/2017 ####WDAPPServer02A 2017-10-07T23:45:15.257-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02A 2017-10-08T23:45:53.773-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02A 2017-10-08T23:50:59.393-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02A 2017-10-09T23:45:11.293-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02G 2017-10-06T23:45:48.840-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02G 2017-10-07T23:45:15.257-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02G 2017-10-08T23:45:53.773-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02G 2017-10-08T23:50:59.393-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02G 2017-10-09T23:45:11.293-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02H 2017-10-06T23:45:48.840-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02H 2017-10-07T23:45:15.257-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02H 2017-10-08T23:45:53.773-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02H 2017-10-08T23:50:59.393-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02H 2017-10-09T23:45:11.293-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer03B 2017-10-06T23:45:48.840-0500 Windows Server 2012 R2 9/16/2017 27 9/19/2017 ####WDAPPServer03B 2017-10-07T23:45:15.257-0500 Windows Server 2012 R2 9/16/2017 27 9/16/2017 </CODE></PRE> Tue, 29 Sep 2020 16:15:23 GMT https://community.splunk.com/t5/Splunk-Search/Streamstats-Question/m-p/307137#M92099 jhayIV 2020-09-29T16:15:23Z https://community.splunk.com/t5/Splunk-Search/Streamstats-Question/m-p/307138#M92100 <P>you can use earliest(_time) and latest(_time) for each host, all hosts with earliest as today are new added servers and server with latest as yesterday are removed today.</P> Tue, 29 Sep 2020 16:10:55 GMT https://community.splunk.com/t5/Splunk-Search/Streamstats-Question/m-p/307138#M92100 kyaparla 2020-09-29T16:10:55Z