Splunk Search

Compare the same search over two different time periods

iainp
New Member

I have a number of devices that send logs to Splunk.

I want to know when devices stop logging.

For this example search:

index="mydevices" logdesc="Something that speeds the search" | top limit=40 devicename

How can i find "devicename"s that have logged in the last week that haven't logged in the last 30 minutes?

if that makes sense.

Iain.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @iainp,

you could try something like this:

index="mydevices" logdesc="Something that speeds the search" earliest=-7d@d latest=now
| eval period=if(now()-_time<1800,"Last 30 minutes","Previous")
| stats 
   dc(period) AS period_count 
   values(period) AS period
   count
   BY devicename
| where period_count=1 period="Previous"
| table devicename

See my approach and adapt it to your Use Case.

Ciao.

Giuseppe

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats latest(_time) as lasttime by devicename
| where now()-lasttime > 1800
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...