Splunk Search

How to compare two scan results from two different dates and display the differences from one index?

ephrem3232
Explorer

I am new to splunk. I need to find the difference in the two scan results from two different dates. Someone suggested the use of set and diff combination. Can anyone give me a lead on how to accomplish this? 

 

Thank you

Labels (5)
Tags (2)
0 Karma

to4kawa
Ultra Champion

sample:

index=_internal (earliest=-24h latest=-23h) OR (earliest=-2h latest=-1h)

Why don't you use two earliest and latest  like above?

reference:

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchTimeModifiers

ephrem3232
Explorer

Thank you for your comment. I've already extracted the data from the time frame of 5/31 and 6/7 but from the list of findings I need to  identify the issues that  are not in the more recent result (6/7). The difference between the main search and sub search.

Thank you,

0 Karma

to4kawa
Ultra Champion
| eval date=case(strftime(_time,"%F")="2020-05-31","before",strftime(_time,"%F")="2020-06-07","current")

I don't know what you're looking for, but the distinction can be made this way.

| stats count(eval(date="before")) as count_before count(eval(date="current")) as count_current  

The number of logs can now be compared. 

0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...