Compare the same search over two different time periods

[iainp]

I have a number of devices that send logs to Splunk.

I want to know when devices stop logging.

For this example search:

index="mydevices" logdesc="Something that speeds the search" | top limit=40 devicename

How can i find "devicename"s that have logged in the last week that haven't logged in the last 30 minutes?

if that makes sense.

Iain.

[gcusello]

Hi @iainp,

you could try something like this:

index="mydevices" logdesc="Something that speeds the search" earliest=-7d@d latest=now
| eval period=if(now()-_time<1800,"Last 30 minutes","Previous")
| stats 
   dc(period) AS period_count 
   values(period) AS period
   count
   BY devicename
| where period_count=1 period="Previous"
| table devicename

See my approach and adapt it to your Use Case.

Ciao.

Giuseppe

[ITWhisperer]

| stats latest(_time) as lasttime by devicename
| where now()-lasttime > 1800