Alerting

Compare results from two timeframes and show differences?

mistydennis
Communicator

Hello Splunk experts - I am trying to create a query that shows the difference in results from two distinct time frames. 

Original search:

 

index=summary_nexpose
| table AssetName, cveID, Exposure
| mvcombine delim=",", cveID 
| nomv cveID 
| eval numberCVEs=mvcount(split(cveID,",")) 
| rename numberCVEs AS "Number of CVEs"

 

What I need to do is add two timeframes: results from 30 days ago vs. results from today, and then show the difference in events between those two timeframes.

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

So, Asset count * Exposure types = 68?

Not sure how you get 2584 rows from that stats command.

Anyway, so in your example, does the server1 row indicate that today has 1 CVE and 30 days ago there were none? How do you want to reflect 'difference'.

You can try something like this

...
| stats count values(cveID) as cveID by _time AssetName Exposure
| nomv cveID
| stats list(_time) as time list(*) as * by AssetName Exposure
| eval time=strftime(time, "%F %T")
| where mvcount(cveID)=1 OR mvindex(cveID, 0)!=mvindex(cveID,1)
| table AssetName cveID Exposure count
 

 

View solution in original post

0 Karma

mistydennis
Communicator

So that query gives me all the results from both days (2,584 rows). What I want to find out is how the results are different from both days. With my data set there should be 136 rows.

The desired outcome is a table that looks like this:

AssetNamecveIDExposureNumber of CVEs
server1cve1Internal1
server 2cve1, cve2, cve3Internal3
0 Karma

bowesmana
SplunkTrust
SplunkTrust

So, Asset count * Exposure types = 68?

Not sure how you get 2584 rows from that stats command.

Anyway, so in your example, does the server1 row indicate that today has 1 CVE and 30 days ago there were none? How do you want to reflect 'difference'.

You can try something like this

...
| stats count values(cveID) as cveID by _time AssetName Exposure
| nomv cveID
| stats list(_time) as time list(*) as * by AssetName Exposure
| eval time=strftime(time, "%F %T")
| where mvcount(cveID)=1 OR mvindex(cveID, 0)!=mvindex(cveID,1)
| table AssetName cveID Exposure count
 

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use 2 data set ranges. I am not sure what the idea is behind mvcombine and then splitting and counting, but does this start to work for you?

index=summary_nexpose (earliest=@d latest=now) OR  
                      (earliest=-30d@d latest=-29d@d)
| bin _time span=1d
| stats count(cveID) as "Number of CVEs" values(cveID) by _time AssetName, Exposure

Not sure what you want to do with your comparison. logic 

What do you want to see from a comparison - a table form or chart or...?

Do you want the two dates combined to both values on the same row?

 

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...