Splunk Search

How to compare two scan results from two different dates and display the differences from one index?

ephrem3232
Explorer

I am new to splunk. I need to find the difference in the two scan results from two different dates. Someone suggested the use of set and diff combination. Can anyone give me a lead on how to accomplish this? 

 

Thank you

Labels (5)
Tags (2)
0 Karma

to4kawa
Ultra Champion

sample:

index=_internal (earliest=-24h latest=-23h) OR (earliest=-2h latest=-1h)

Why don't you use two earliest and latest  like above?

reference:

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchTimeModifiers

ephrem3232
Explorer

Thank you for your comment. I've already extracted the data from the time frame of 5/31 and 6/7 but from the list of findings I need to  identify the issues that  are not in the more recent result (6/7). The difference between the main search and sub search.

Thank you,

0 Karma

to4kawa
Ultra Champion
| eval date=case(strftime(_time,"%F")="2020-05-31","before",strftime(_time,"%F")="2020-06-07","current")

I don't know what you're looking for, but the distinction can be made this way.

| stats count(eval(date="before")) as count_before count(eval(date="current")) as count_current  

The number of logs can now be compared. 

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...