Compare data for 1 hour

Getting Data In

I am currently running a search which provides Name of host which are unregistered at a particular time and then after 1 hour run same search to fetch unregistered host

Then I manually compare 2 reports for name of host were unregistered in first report and now changed to registered in next report.

Based on the data compared for unregistered an registered host I take necessary action on unregistered host..

My question--is there a way we can compare the data for 1 hour in 1 single search??

Query currently use is - -

| input lookup R2VirtualDedktopAssignments | where Environment=PROD And Registrations tate =Unregistered

Get Updates on the Splunk Community!

Compare data for 1 hour

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster

What's New in Splunk Enterprise Security 8.8 and Beyond

A Four-Part Event Series: State of Observability - Where AI Meets Performance

Join the Conversation

Compare data for 1 hour

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster

What's New in Splunk Enterprise Security 8.8 and Beyond

A Four-Part Event Series: State of Observability - Where AI Meets Performance