Splunk Search

How to write a search to find the difference between values in multiple fields?

Path Finder

Hello,

I would like to find the difference between values in a couple of fields for two months.

I figured out how to do that just for one field:

|set diff [search index = test_im  REPORT_PERIOD="2015-10-01 00:00:00"| stats count by Client Type Type2| fields - count] [search index = test_im  REPORT_PERIOD="2015-09-01 00:00:00"| stats count by Client Type Type2 | fields - count]

However, for a couple fields, it's not working properly. It would be nice if the result looked like this (unique difference values):

Client Type Type2
<difference unique values> <difference unique values> <difference unique values>

Thank you

0 Karma

Path Finder

Hi,

Here is the option that you can use. I assume you have a variables called REPORT_PERIOD. Then you can use join or depends on visualization and your needs you can also use appendcols command.

     search index = test_im REPORT_PERIOD="2015-10-01 00:00:00"| stats count by Client Type Type2|fields - count 
|join REPORT_PERIOD  [search index = test_im REPORT_PERIOD="2015-09-01 00:00:00"|stats count by Client Type Type2|fields - count]
|table Client,Type,Type2

You can find more details from the link below.
http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Join
http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Appendcols

Hope it is clear.

Thanks

Gokhan

Path Finder

Hi
Unfortunately this is not working. I want to see the different unique values which are exist in one data set and not exist in second one.

e.g. If a new client appear in new month this need to be shown
or if a client which exists in previous month but in current month is not visible

Thank you with helping here

0 Karma

Path Finder

Hi ,

Is there any chance to give those data set tables as an example?

Is it logged clients or new user registration data? I mean you can see the 1 person information more than 1 time in 1 data set in the same period?

Thanks

Gokhan

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!