Splunk Search

How to find the difference between columns headers (new column headers one month that don't exist in the previous month)?

akawacz
Path Finder

Hello

I am trying to find a differecne between column headers (month to another month). Meaning, if in the new month there are some new columns headers which do not exist in the previous month.

|set diff [search index = A PERIOD="2015-08-01 00:00:00" | stats dc(*) as * |transpose | table column] [search index = A PERIOD="2015-09-01 00:00:00" | stats dc(*) as * |transpose | table column]

above search shows me 27 values, but it should be just one. Also I was trying to use foreach, but haven't had any luck there.

0 Karma
1 Solution

HeinzWaescher
Motivator

Do you want to see the names of the new headers?
I can think of something like this:

Set the timerangepicker to the 2 months you want to compare.

....
| bucket span=1mon _time

| stats count() AS * BY _time
| transpose

| rename "row 1" -> previous_month, "row 2" -> current_month
| search previous_month=0 AND row2>0

View solution in original post

0 Karma

HeinzWaescher
Motivator

Do you want to see the names of the new headers?
I can think of something like this:

Set the timerangepicker to the 2 months you want to compare.

....
| bucket span=1mon _time

| stats count() AS * BY _time
| transpose

| rename "row 1" -> previous_month, "row 2" -> current_month
| search previous_month=0 AND row2>0
0 Karma

akawacz
Path Finder

HI

I have gave the same result what my search as well (which I have just corrected). However both shows one filed with 0 but the value is visibe in 2 month. What can be the reason ?

I have corrected my search like that :
|set diff [search index = A earliest=-7d@mon-1mon-1d latest=-7d@mon-1d | stats dc() as * |transpose | table column] [search index = A earliest=-7d@mon-2mon-1d | stats dc() as * |transpose | table column]

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...