Find field value present today, that was not logged yesterday.

[afs_splunk]

We have a splunk query that pulls down a list of values daily.  We are looking to see if we can use splunk to find the field value that is new today, but was not present yesterday, and show in a stats table.

How can this be accomplished?  The idea is..

Yesterday - splunk db connect query pulls back a result of 5 log lines, all containing the field "name".
field= name

values - Bob, Kat, Abe, Doug, Sam

Today - splunk db connect query pulls back a result of 6 log lines, all containing field "name".

field= name

values - Bob, Kat, Abe, Doug, Sam, Jim(new value found)

So would like to show a stats table or alert that would let us know "Jim" is a new field value for name that did not exist yesterday.

[yuanliu]

Should we assume that DB connect queries are independently performed on two days?  In other words, there is no DB connect query to tell you which names appeared yesterday and which today?

In this case, you will need to save your output from yesterday for today's use.  If you don't want to offend time travel authorities, this practically means you need to save your output from today for tomorrow's use.  Something like

| inputlookup yesterday.csv ``` assume you did outputlookup yesterday ```
| rename name AS yesterday
| appendcols
    [dbxquery connection="myDBconnect" query="select name from myDB"
    | outputlookup yesterday.csv ``` save for use tommorrow ```
    | rename name AS today ]
| where isnull(yesterday)

Here, I use inputlookup and outputlookup (or inputcsv/outputcsv) as example.  If you prefer, you can set up a separate table to store yesterday and use dbxquery/dbxoutput.  Hope this helps.