Splunk Search

Difference between today's and yesterday's data.

3666142
Path Finder

I am trying to find the difference between today and yesterday's data. The data consists of every employee's Id number and first/last name. So I just want to know if the company hired within the last day. This is the search query that I currently have. Does the "earliest" and "latest" format make sense (like the -1d@d). Also, if there is not a difference between the two days, how do I have Splunk display a chart that says, "No diff."? Thanks.

| set diff
[ search index="ABCD" (earliest=@d)
| table Employee_number First_name Last_name]
[ search index="ABCD" (earliest=-1d@d latest=@d-1)
| table Employee_number First_name Last_name]

0 Karma
1 Solution

adonio
Ultra Champion

for something like this a lookup might be better imho

another way to do it is maybe to search for the last couple of days, then check in how many unique days an ID appears
if 1 day, then it was hired that day, if greater, then one, it was there yesterday

something like this:
... index="ABCD" Employee_number=* | bin _time span=24h | stats dc(Employee_number) as new_or_not by _time
| eval new_or_not = if(new_or_not=="1","New Person","Long Time Employee") ...

hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

for something like this a lookup might be better imho

another way to do it is maybe to search for the last couple of days, then check in how many unique days an ID appears
if 1 day, then it was hired that day, if greater, then one, it was there yesterday

something like this:
... index="ABCD" Employee_number=* | bin _time span=24h | stats dc(Employee_number) as new_or_not by _time
| eval new_or_not = if(new_or_not=="1","New Person","Long Time Employee") ...

hope it helps

0 Karma

3666142
Path Finder

Thank you. That definitely put me in the right direction.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...