All Apps and Add-ons

comparing results from 2 days

michal_centralw
Explorer

Hi,

Is there a way to compare results of number of hosts reporting from 2 different days and show only the one which are different?
I tried the following search

unix_category="WEB PROD" earliest=-0d@d latest=now | dedup host| table host | sort by host | append [search unix_category="WEB PROD" earliest=-1d@d latest=-0d@d]

But that was only showing me all the hosts, not the difference.

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

| set diff [search unix_category="WEB PROD" earliest=-0d@d latest=now | stats count by host | fields - count] [search unix_category="WEB PROD" earliest=-1d@d latest=@d| stats count by host | fields - count]

OR

unix_category="WEB PROD" earliest=-2d@d latest=now | stats values(date_mday) as Days by host | where mvcount(Days)=1

View solution in original post

somesoni2
Revered Legend

Try this

| set diff [search unix_category="WEB PROD" earliest=-0d@d latest=now | stats count by host | fields - count] [search unix_category="WEB PROD" earliest=-1d@d latest=@d| stats count by host | fields - count]

OR

unix_category="WEB PROD" earliest=-2d@d latest=now | stats values(date_mday) as Days by host | where mvcount(Days)=1

aweitzman
Motivator

One thing that works nicely with the "| set diff" answer is to copy the field you're comparing to one with a different name (eval host2=host | stats count by host2) in the second search. Then when you get the results, each set's difference is in its own column (rather than combined together).

0 Karma

michal_centralw
Explorer

superb! the first search worked like a charm!

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...