I have a splunk instance digesting nmap results. Each host that is found on the network generates an event that has information like IP and MAC addresses.
How can I formulate a search that would show me MAC addresses that were discovered for the first time in the last day or so?
I tried doing something like this:
NOT ([search earliest=-30d latest=-1d | table mac]) | table mac ip_address hostname
But that didn't actually remove any hosts that had been seen before.
Have you tried a more explicit search?
index=nmap_index earliest=-1d NOT ([search index=nmap_index earliest=-30d latest=-1d | fields mac | format])
| table mac ip_address hostname