Difference between today's and yesterday's data.

[3666142]

I am trying to find the difference between today and yesterday's data. The data consists of every employee's Id number and first/last name. So I just want to know if the company hired within the last day. This is the search query that I currently have. Does the "earliest" and "latest" format make sense (like the -1d@d). Also, if there is not a difference between the two days, how do I have Splunk display a chart that says, "No diff."? Thanks.

| set diff
[ search index="ABCD" (earliest=@d)
| table Employee_number First_name Last_name]
[ search index="ABCD" (earliest=-1d@d latest=@d-1)
| table Employee_number First_name Last_name]

[adonio · Accepted solution]

for something like this a lookup might be better imho

another way to do it is maybe to search for the last couple of days, then check in how many unique days an ID appears
if 1 day, then it was hired that day, if greater, then one, it was there yesterday

something like this:
... index="ABCD" Employee_number=* | bin _time span=24h | stats dc(Employee_number) as new_or_not by _time
| eval new_or_not = if(new_or_not=="1","New Person","Long Time Employee") ...

hope it helps

[3666142]

Thank you. That definitely put me in the right direction.