Splunk Search

How to count number of occurrences made of a "set diff" command, using a different time range

evang_26
Communicator

Hi,

I am challenging myself to solve a problem which came up last week.

The idea is to first make a set diff between two different time frames which result to an IP table, and then take all those IPs and count how many times they appeared in a much larger time frame.

I have "set diff" working for now, giving me the IP table with the uncommon IPs correctly. What I can't think of, is how/where to feed this table.

| set diff [search source=*Host_Enumeration*  earliest=-14d@d latest=-8d@d    | stats count by dest_ip |sort dest_ip  | table dest_ip ] [search source=*Host_Enumeration* earliest=-7d@d latest=now   | stats count by dest_ip  |sort dest_ip  | table dest_ip ] | search earliest=-30d latest=now | stats count(dest_ip) by dest_ip

Above query works till the end of "set diff". Where everything is screwed up is on the search.

I am not sure if this is very easy or not, but if you could give me a hint or whatever, I would be grateful.

Regards,
Evang

1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this (assuming, for searching in the longer period, the source remains the same)

source=*Host_Enumeration* earliest=-30d latest=now  [| set diff [search source=*Host_Enumeration*  earliest=-14d@d latest=-8d@d    | stats count by dest_ip |sort dest_ip  | table dest_ip ] [search source=*Host_Enumeration* earliest=-7d@d latest=now   | stats count by dest_ip  |sort dest_ip  | table dest_ip ]] 
| stats count(dest_ip) by dest_ip

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try this (assuming, for searching in the longer period, the source remains the same)

source=*Host_Enumeration* earliest=-30d latest=now  [| set diff [search source=*Host_Enumeration*  earliest=-14d@d latest=-8d@d    | stats count by dest_ip |sort dest_ip  | table dest_ip ] [search source=*Host_Enumeration* earliest=-7d@d latest=now   | stats count by dest_ip  |sort dest_ip  | table dest_ip ]] 
| stats count(dest_ip) by dest_ip

evang_26
Communicator

Thank you very much somesoni2.

That worked perfectly!

Regards,
Evang

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...