How can I compare a list of users to another set?

[daniel333]

All,

Say I query Splunk and get a list of 1000 users today. And tomomorrow I do the same thing and get 1002 users. How can I get the 2 new users appeared over night? Basically diff the results of two searches?

[somesoni2]

Try like this

your base search ran with time-range for last two days (yesterday and day before yesterday) earliest=-2d@d latest=@d| eval day=strftime(_time,"%m/%d/%Y") | stats values(day) as days by user | where mvcount(days)=1  AND days=strftime(relative_time(now(),"-1d@d"),"%m/%d/%Y")