Comparing the results in different time range?

[smanojkumar]

Hi Splunkers!

   Good day!

   I need a search which extracts the count of serial_number of different time range and i should calculate the difference, if its greater than 5000, it should trigger an alert,

index="inventory" origin="Inventory:ITSM" earliest=-6h latest=now()
| fields serial_number
| stats count(serial_number) as total_assets
| search [ search index="inventory" origin="Inventory:ITSM" earliest=-12h latest=-6h
| fields serial_number
| stats count(serial_number) as total_assets_prev]
| eval diff=total_assets_prev-total_assets
| where diff>5000
| eval message="Hello Team, the assets in ITSM origin is less than 65000 and its actual value is "
| table message, total_assets_prev, total_assets

This query is not working.

Thanks in advance!

Manoj Kumar S

[isoutamo]

Hi

You could use relative_time function to divide your events like this

index="inventory" origin="Inventory:ITSM" earliest=-12h latest=now()
| eval period = if (_time < relative_time(now(),"-6h"), "previous", "current")
| stats count(search_id) as total_si by period
| eval {period}=total_si
| fields current previous
| stats sum(*) as *
| eval diff = previous - current
| where diff > 5000
| eval message="Hello Team, the assets in ITSM origin is less than 65000 and its actual value is "
| table message, previous current

There are also other ways to do it.

r. Ismo 

[ITWhisperer]

index="inventory" origin="Inventory:ITSM" earliest=-12h latest=now()
| fields serial_number
| stats count(eval(_time<relative_time(now(),"-6h"))) as total_assets_prev count(eval(_time>relative_time(now(),"-6h"))) as total_assets
| eval diff=total_assets_prev-total_assets
| where diff>5000
| eval message="Hello Team, the assets in ITSM origin is less than 65000 and its actual value is "
| table message, total_assets_prev, total_assets

[smanojkumar]

Hi @ITWhisperer ,

   Thanks for your response!

    I'm getting total_assets_prev as 0,

    (My requirement is calculate the count of serial_number of time range -12 hr to -6hr and count of serial_number for the time range -6hr to now and calculate the difference)

Thanks in advance!

Manoj Kumar S

[ITWhisperer]

Remove this line

| fields serial_number