Splunk Search

How to write a search to find the difference between values in multiple fields?

akawacz
Path Finder

Hello,

I would like to find the difference between values in a couple of fields for two months.

I figured out how to do that just for one field:

|set diff [search index = test_im  REPORT_PERIOD="2015-10-01 00:00:00"| stats count by Client Type Type2| fields - count] [search index = test_im  REPORT_PERIOD="2015-09-01 00:00:00"| stats count by Client Type Type2 | fields - count]

However, for a couple fields, it's not working properly. It would be nice if the result looked like this (unique difference values):

Client Type Type2
<difference unique values> <difference unique values> <difference unique values>

Thank you

0 Karma

gyarici
Path Finder

Hi,

Here is the option that you can use. I assume you have a variables called REPORT_PERIOD. Then you can use join or depends on visualization and your needs you can also use appendcols command.

     search index = test_im REPORT_PERIOD="2015-10-01 00:00:00"| stats count by Client Type Type2|fields - count 
|join REPORT_PERIOD  [search index = test_im REPORT_PERIOD="2015-09-01 00:00:00"|stats count by Client Type Type2|fields - count]
|table Client,Type,Type2

You can find more details from the link below.
http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Join
http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Appendcols

Hope it is clear.

Thanks

Gokhan

akawacz
Path Finder

Hi
Unfortunately this is not working. I want to see the different unique values which are exist in one data set and not exist in second one.

e.g. If a new client appear in new month this need to be shown
or if a client which exists in previous month but in current month is not visible

Thank you with helping here

0 Karma

gyarici
Path Finder

Hi ,

Is there any chance to give those data set tables as an example?

Is it logged clients or new user registration data? I mean you can see the 1 person information more than 1 time in 1 data set in the same period?

Thanks

Gokhan

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...