Splunk Enterprise

Compare two searches and get the difference in table results?

piyushpandey
Engager

Hello, I have logs containing two fields "account" and "shard". 

By doing "| table account shard"
I created a table of two cols 

and since the table can have repeating values like:
account                  shard
100                           21
100                           21
100                           8
101                           10

I did "| stats dc(shard) by account", which gives me:
account                 shard
100                          2
101                          1

I have two such tables(before and after) of "account" vs "dc(shard)" and I want to compare them(get the diff in distinct no of shards for each account before and after), but struggling to do this. 
Please guide me to get the result. 
[I can explain anything thats unclear]

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Combine your searches and evaluate another field (period) with the appropriate value ("before" or "after"), then use the additional field in the stats command

| stats dc(shard) by account period
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...