How to compare new and existing data

[mbasharat]

Hi,

I have a field name VULN in index=ABC sourcetype=XYZ.

We need to know, if new VULN show up in 48hrs of data compared to 1 month ago. Basically, we need to see how many new VULNs are in data compared to last month and how many unique IPs are affected. 

Thanks in-advance!!!

[gcusello]

Hi @mbasharat,

you could try something like this:

index=ABC sourcetype=XYZ VULN=* earliest=-mon latest=now
| eval period=if(now()-_time>-3600*48,"Before","Last_48_hours")
| stats dc(period) AS dc_period values(period) AS period BY VULN
| where dc_period=1 AND period="Last_48_hours"
| table VULN

In this way you'll have the VULNs present in the last 48 hours but not in the last month.

Ciao.

Giuseppe

[mbasharat]

Hi @gcusello 

I tried and I am getting no results for this. Then I removed Last_48_hrs and everything is falling under "Before"

[gcusello · Accepted solution]

Hi @mbasharat,

sorry there was a mistyping, please try this:

index=ABC sourcetype=XYZ VULN=* earliest=-mon latest=now
| eval period=if(now()-_time>3600*48,"Before","Last_48_hours")
| stats dc(period) AS dc_period values(period) AS period BY VULN
| where dc_period=1 AND period="Last_48_hours"
| table VULN

There was a wrong less char "-".

Ciao.

Giuseppe

[gcusello]

Hi @mbasharat,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉