Splunk Search

How to find the difference between columns headers (new column headers one month that don't exist in the previous month)?

akawacz
Path Finder

Hello

I am trying to find a differecne between column headers (month to another month). Meaning, if in the new month there are some new columns headers which do not exist in the previous month.

|set diff [search index = A PERIOD="2015-08-01 00:00:00" | stats dc(*) as * |transpose | table column] [search index = A PERIOD="2015-09-01 00:00:00" | stats dc(*) as * |transpose | table column]

above search shows me 27 values, but it should be just one. Also I was trying to use foreach, but haven't had any luck there.

0 Karma
1 Solution

HeinzWaescher
Motivator

Do you want to see the names of the new headers?
I can think of something like this:

Set the timerangepicker to the 2 months you want to compare.

....
| bucket span=1mon _time

| stats count() AS * BY _time
| transpose

| rename "row 1" -> previous_month, "row 2" -> current_month
| search previous_month=0 AND row2>0

View solution in original post

0 Karma

HeinzWaescher
Motivator

Do you want to see the names of the new headers?
I can think of something like this:

Set the timerangepicker to the 2 months you want to compare.

....
| bucket span=1mon _time

| stats count() AS * BY _time
| transpose

| rename "row 1" -> previous_month, "row 2" -> current_month
| search previous_month=0 AND row2>0
0 Karma

akawacz
Path Finder

HI

I have gave the same result what my search as well (which I have just corrected). However both shows one filed with 0 but the value is visibe in 2 month. What can be the reason ?

I have corrected my search like that :
|set diff [search index = A earliest=-7d@mon-1mon-1d latest=-7d@mon-1d | stats dc() as * |transpose | table column] [search index = A earliest=-7d@mon-2mon-1d | stats dc() as * |transpose | table column]

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...