The searches look like this in their base form
| tstats count where index=nix_os earliest=07/10/2020:00:00:00 latest=07/10/2020:23:59:59 by host
| tstats count where index=nix_os earliest=07/09/2020:00:00:00 latest=07/09/2020:23:59:59 by host
I was trying something like this but I can't seem to get it just right:
| tstats count where index=nix_os earliest=07/09/2020:00:00:00 latest=07/09/2020:23:59:59 by host
[| tstats append=true count where index=nix_os earliest=07/10/2020:00:00:00 latest=07/10/2020:23:59:59 by host prestats=true
| stats count as newhost by host]
My goal is to find hosts that were not logging on the 9th that started on the 10th
thanks for the help!
The append command works.
| tstats count where index=nix_os earliest=07/09/2020:00:00:00 latest=07/09/2020:23:59:59 by host
| append [| tstats count where index=nix_os earliest=07/10/2020:00:00:00 latest=07/10/2020:23:59:59 by host prestats=true
| stats count as newhost by host]
| stats values(*) as * by host
The append command works.
| tstats count where index=nix_os earliest=07/09/2020:00:00:00 latest=07/09/2020:23:59:59 by host
| append [| tstats count where index=nix_os earliest=07/10/2020:00:00:00 latest=07/10/2020:23:59:59 by host prestats=true
| stats count as newhost by host]
| stats values(*) as * by host