Comparing results from 2 days?

[pbabos]

Hello, I'm struggling with a task and would like to ask for your opinion about it. Goal is to set up an alert, which would fire an event in case the last 24h results differ from the one from 24h-48h before, and to also show the difference.

I was trying to have something like:

| set diff [search message="Connected to system:*" earliest=-24h  | rex field=connectedSystemName message="Connected to system: (?<systemName>.+)" | stats values(connectedSystemName) as system_names] [search message="Connected to system:*" earliest=-48h latest=-24h | rex field=connectedSystemName message="Connected to system: (?<systemName>.+)" | stats values(connectedSystemName) as system_names]

My results from this search is one coloumn of a list of the names of the connected systems. How could I reach such comparisment to also show the differences?

Thanks a lot in advance!
Peter

[ITWhisperer · Accepted solution]

Try something like this

<first search last 24 hours>
| eval period = 1
| append [search <second search previous 24 hours>
  | eval period = 2]
| stats sum(period) as periods by systemName

If periods = 1, it is only in the first search

If periods = 2, it is only in the second search

If periods = 3, it is in both periods

[pbabos]

wow nice, thanks, this is something I can work with! 🙂