How to create a summary index to compare data with daily?

[phudinhha]

Good afternoon, everyone

I'm looking for a solution for my idea like this:
Today, I want to create a first baseline of domain requests that computers in our network send to our DNS server. I've created a search that gave me a unique list of domains(domain) + count of domain (Count). I want to use this result as a baseline. So tomorrow, I can run the same search that shows me new domains that our computer requests.
1 - compare new data with the baseline, if no new domain, the result is 0. If we have a new domain, print out the new domain only. This new domain will be added to the baseline as baseline-new.
2 - the day after tomorrow, the same search will run and give us new domain again.

Is there anyway that we can achieve such result in Splunk?

Below is my search for now:

index=domain dns_server earliest = -30d latest=now
| dedup domain
| stats count as Count, values(domain)

Thank you so much

[martin_mueller]

This describes a way how to keep such state: http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/

If you remember to include a "first seen" timestamp, you can run searches against your state data for "new domains today", "new domains this week", etc.

Side note: Instead of | dedup | stats, consider | stats count by domain

[phudinhha]

any solution for me?