I am looking for a splunk solution for the below representation. This is basically, comparing the data on a field on two dates and find out which are not common on both dates.
So the output should be two values,
1. Added items count, compared to previous date.
2. Removed items count, compared to previous date.
Any suggestions for how to achieve this?
below is the one I tried, but gives only total difference, but i need 'Added' and 'Removed' items count separately.
| set diff [search sourcetype=data earliest=-3d@d latest=-2d@d |fields hostname, date_time| stats count by dest_ip |table dest_ip] [search sourcetype=data earliest=-1d@d latest=now |fields hostname, date_time| stats count by hostname|hostname]
Note: delta command doesn’t work in the below case.
Hi @vijeshbosch,
Try this
<your base search >
|timechart span=1d count by hostname useother=f limit=0
|untable _time,hostname,count|sort hostname|streamstats current=f last(count) as next by hostname|fillnull value="NA"
|eval diff=if(next == "NA",count,count-next)|table _time,hostname,count,next,diff
|eval status=case(diff>=1,"ADDED",diff<=-1,"REMOVED",1==1,"NO CHANGE")
|stats count(eval(status=="ADDED")) as added,count(eval(status=="REMOVED")) as removed by _time
Hi @vijeshbosch,
Try this
<your base search >
|timechart span=1d count by hostname useother=f limit=0
|untable _time,hostname,count|sort hostname|streamstats current=f last(count) as next by hostname|fillnull value="NA"
|eval diff=if(next == "NA",count,count-next)|table _time,hostname,count,next,diff
|eval status=case(diff>=1,"ADDED",diff<=-1,"REMOVED",1==1,"NO CHANGE")
|stats count(eval(status=="ADDED")) as added,count(eval(status=="REMOVED")) as removed by _time