Splunk Search

How to find the difference from the previous day in a lookup table?



How to use Splunk query to compare to the "count" field from previous day from a lookup table? For instance, the lookup table has fields:

date             item            count
-------         -------         ---------
04/20/2018        box              12
04/19/2018        box              20
The end result looks like:
    date             item            count      diff
    -------         -------         ---------   ------
    04/20/2018        box              12        -8   


0 Karma


The delta command is what you'll be using, but with your source events sorted in reverse-chronological order (as they are above), it will put your diff value on the wrong line. So try this:

your current search that gives  you the first table
| reverse
| delta count AS diff

Here are the docs on delta:

0 Karma


Thanks elliotproebstel. This is what I am looking for. I have another question: between "reverse" and "delta" subsearch, how can I loop through a lookup table and calculate the diff only matched to the lookup? Thanks.

0 Karma


That will be pretty easy, but to help you structure the query, can you tell me what field in your current search you'll be looking to match and the name of the column/field in the lookup table that you're matching to?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...