Splunk Search

How to compare two scan results from two different dates and display the differences from one index?

ephrem3232
Explorer

I am new to splunk. I need to find the difference in the two scan results from two different dates. Someone suggested the use of set and diff combination. Can anyone give me a lead on how to accomplish this? 

 

Thank you

Labels (5)
Tags (2)
0 Karma

to4kawa
Ultra Champion

sample:

index=_internal (earliest=-24h latest=-23h) OR (earliest=-2h latest=-1h)

Why don't you use two earliest and latest  like above?

reference:

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchTimeModifiers

ephrem3232
Explorer

Thank you for your comment. I've already extracted the data from the time frame of 5/31 and 6/7 but from the list of findings I need to  identify the issues that  are not in the more recent result (6/7). The difference between the main search and sub search.

Thank you,

0 Karma

to4kawa
Ultra Champion
| eval date=case(strftime(_time,"%F")="2020-05-31","before",strftime(_time,"%F")="2020-06-07","current")

I don't know what you're looking for, but the distinction can be made this way.

| stats count(eval(date="before")) as count_before count(eval(date="current")) as count_current  

The number of logs can now be compared. 

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...