topic Re: Searching issues in comparing data in Splunk Search

Searching issues in comparing data

user290317 — Wed, 05 Apr 2017 21:12:16 GMT

Hi Splunker beginner here.

I'm having an issue in forming the search syntax for comparing the biggest amount of client logs deleted accidentally on a current day as opposed to the average of the previous month. I'm here at the moment source="deleted.xml" earliest=-d ACCIDENTAL_DELETES > ...

Re: Searching issues in comparing data

user290317 — Wed, 05 Apr 2017 21:24:40 GMT

To be more specific I'm searching for all the amounts of accidental deletes on the current day that supersedes the avg for the previous month.

Re: Searching issues in comparing data

somesoni2 — Wed, 05 Apr 2017 21:49:59 GMT

The pseudo search would be like this

source="deleted.xml" earliest=@d ACCIDENTAL_DELETES > ...
| stats count by client_indentifier_field
| where count>[search source="deleted.xml" earliest=-1mon@m latest=@mon ACCIDENTAL_DELETES > ..   | query to calculate last month's average | table average | rename average  as query]

Re: Searching issues in comparing data

user290317 — Thu, 06 Apr 2017 09:58:59 GMT

With some additional play around with the syntax I managed to solve it. Thanks.