Splunk Search

How to eliminate identical values of two similar fields?

Path Finder

Suppose I have a field called TESTS which contains some values. This field changes every day (each day is represented by a field called TIMESTAMP).
I would like to isolate only those tests that differ from previous day to the following. Only those tests that appeared yesterday but not today.

For instance:
| tests | day |
|--------| ------|
| a,b,c | 1 |
| a,c | 2 |

The DIFFERENCE field should contain only b


0 Karma


I'm going to focus on your final goal statement, which is to find: "Only those tests that appeared yesterday but not today." I'll assume that each test appears in a field called test.

Step 1: List all tests that occurred in the overall timeframe (yesterday and today)

index=something earliest=-1d@d latest=now test=*

Step 2: Identify the latest time that each test ran

| stats latest(_time) AS last_ran BY test

Step 3: Filter for tests that ran yesterday and did not run today

| eval midnight=relative_time(now(), "@d")
| where last_ran<=midnight

This will leave tests that were seen within the overall time window but were not seen today. So putting it all together:

index=something earliest=-1d@d latest=now test=*
| stats latest(_time) AS last_ran BY test
| eval midnight=relative_time(now(), "@d")
| where last_ran<=midnight

The solution by @p_gurav will display all events that occurred on only one day (i.e. only yesterday OR only today), but it won't tell you on which day they ran.


Hi vshakur,

You can try following query:

| set diff [search index=* earliest=-0d@d latest=now | stats count by tests | fields - count] [search index=* earliest=-1d@d latest=@d| stats count by tests | fields - count]
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! &#x1f44f; Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...