How to compare two scan results from two different dates and display the differences from one index?

[ephrem3232]

I am new to splunk. I need to find the difference in the two scan results from two different dates. Someone suggested the use of set and diff combination. Can anyone give me a lead on how to accomplish this? 

Thank you

[to4kawa]

sample:

index=_internal (earliest=-24h latest=-23h) OR (earliest=-2h latest=-1h)

Why don't you use two earliest and latest  like above?

reference:

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchTimeModifiers

[ephrem3232]

Thank you for your comment. I've already extracted the data from the time frame of 5/31 and 6/7 but from the list of findings I need to  identify the issues that  are not in the more recent result (6/7). The difference between the main search and sub search.

Thank you,

[to4kawa]

| eval date=case(strftime(_time,"%F")="2020-05-31","before",strftime(_time,"%F")="2020-06-07","current")

I don't know what you're looking for, but the distinction can be made this way.

| stats count(eval(date="before")) as count_before count(eval(date="current")) as count_current  

The number of logs can now be compared.