All Apps and Add-ons

comparing results from 2 days

michal_centralw
Explorer

Hi,

Is there a way to compare results of number of hosts reporting from 2 different days and show only the one which are different?
I tried the following search

unix_category="WEB PROD" earliest=-0d@d latest=now | dedup host| table host | sort by host | append [search unix_category="WEB PROD" earliest=-1d@d latest=-0d@d]

But that was only showing me all the hosts, not the difference.

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

| set diff [search unix_category="WEB PROD" earliest=-0d@d latest=now | stats count by host | fields - count] [search unix_category="WEB PROD" earliest=-1d@d latest=@d| stats count by host | fields - count]

OR

unix_category="WEB PROD" earliest=-2d@d latest=now | stats values(date_mday) as Days by host | where mvcount(Days)=1

View solution in original post

somesoni2
Revered Legend

Try this

| set diff [search unix_category="WEB PROD" earliest=-0d@d latest=now | stats count by host | fields - count] [search unix_category="WEB PROD" earliest=-1d@d latest=@d| stats count by host | fields - count]

OR

unix_category="WEB PROD" earliest=-2d@d latest=now | stats values(date_mday) as Days by host | where mvcount(Days)=1

aweitzman
Motivator

One thing that works nicely with the "| set diff" answer is to copy the field you're comparing to one with a different name (eval host2=host | stats count by host2) in the second search. Then when you get the results, each set's difference is in its own column (rather than combined together).

0 Karma

michal_centralw
Explorer

superb! the first search worked like a charm!

Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Hi Splunky people! We are excited to share the newest updates in Splunk Enterprise 9.3!Admins and Analyst can ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...