How to find out the difference in a particular field on each day?

[vijeshbosch]

I am looking for a splunk solution for the below representation. This is basically, comparing the data on a field on two dates and find out which are not common on both dates.

So the output should be two values,
1. Added items count, compared to previous date.
2. Removed items count, compared to previous date.

Any suggestions for how to achieve this?
below is the one I tried, but gives only total difference, but i need 'Added' and 'Removed' items count separately.

 | set diff [search sourcetype=data earliest=-3d@d latest=-2d@d |fields hostname, date_time| stats count by dest_ip |table dest_ip] [search sourcetype=data  earliest=-1d@d latest=now |fields hostname, date_time| stats count by hostname|hostname]

Note: delta command doesn’t work in the below case.

alt text

[renjith_nair · Accepted solution]

Hi @vijeshbosch,

Try this

<your base search >
|timechart span=1d count by hostname useother=f limit=0
|untable _time,hostname,count|sort hostname|streamstats current=f last(count) as next by hostname|fillnull value="NA"
|eval diff=if(next == "NA",count,count-next)|table _time,hostname,count,next,diff
|eval status=case(diff>=1,"ADDED",diff<=-1,"REMOVED",1==1,"NO CHANGE")
|stats count(eval(status=="ADDED")) as added,count(eval(status=="REMOVED")) as removed by _time