Splunk Search

## How to compare new and existing data

Contributor

Hi,

I have a field name VULN in index=ABC sourcetype=XYZ.

We need to know, if new VULN show up in 48hrs of data compared to 1 month ago. Basically, we need to see how many new VULNs are in data compared to last month and how many unique IPs are affected.

Labels (4)

• ### subsearch

1 Solution
Esteemed Legend

Hi @mbasharat,

sorry there was a mistyping, please try this:

``````index=ABC sourcetype=XYZ VULN=* earliest=-mon latest=now
| eval period=if(now()-_time>3600*48,"Before","Last_48_hours")
| stats dc(period) AS dc_period values(period) AS period BY VULN
| where dc_period=1 AND period="Last_48_hours"
| table VULN``````

There was a wrong less char "-".

Ciao.

Giuseppe

Esteemed Legend

Hi @mbasharat,

you could try something like this:

``````index=ABC sourcetype=XYZ VULN=* earliest=-mon latest=now
| eval period=if(now()-_time>-3600*48,"Before","Last_48_hours")
| stats dc(period) AS dc_period values(period) AS period BY VULN
| where dc_period=1 AND period="Last_48_hours"
| table VULN``````

In this way you'll have the VULNs present in the last 48 hours but not in the last month.

Ciao.

Giuseppe

Contributor

I tried and I am getting no results for this. Then I removed Last_48_hrs and everything is falling under "Before"

Esteemed Legend

Hi @mbasharat,

sorry there was a mistyping, please try this:

``````index=ABC sourcetype=XYZ VULN=* earliest=-mon latest=now
| eval period=if(now()-_time>3600*48,"Before","Last_48_hours")
| stats dc(period) AS dc_period values(period) AS period BY VULN
| where dc_period=1 AND period="Last_48_hours"
| table VULN``````

There was a wrong less char "-".

Ciao.

Giuseppe

Esteemed Legend

Hi @mbasharat,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

#### Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

#### There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...