Splunk Search

How to write a search to find the difference between values in multiple fields?

akawacz
Path Finder

Hello,

I would like to find the difference between values in a couple of fields for two months.

I figured out how to do that just for one field:

|set diff [search index = test_im  REPORT_PERIOD="2015-10-01 00:00:00"| stats count by Client Type Type2| fields - count] [search index = test_im  REPORT_PERIOD="2015-09-01 00:00:00"| stats count by Client Type Type2 | fields - count]

However, for a couple fields, it's not working properly. It would be nice if the result looked like this (unique difference values):

Client Type Type2
<difference unique values> <difference unique values> <difference unique values>

Thank you

0 Karma

gyarici
Path Finder

Hi,

Here is the option that you can use. I assume you have a variables called REPORT_PERIOD. Then you can use join or depends on visualization and your needs you can also use appendcols command.

     search index = test_im REPORT_PERIOD="2015-10-01 00:00:00"| stats count by Client Type Type2|fields - count 
|join REPORT_PERIOD  [search index = test_im REPORT_PERIOD="2015-09-01 00:00:00"|stats count by Client Type Type2|fields - count]
|table Client,Type,Type2

You can find more details from the link below.
http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Join
http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Appendcols

Hope it is clear.

Thanks

Gokhan

akawacz
Path Finder

Hi
Unfortunately this is not working. I want to see the different unique values which are exist in one data set and not exist in second one.

e.g. If a new client appear in new month this need to be shown
or if a client which exists in previous month but in current month is not visible

Thank you with helping here

0 Karma

gyarici
Path Finder

Hi ,

Is there any chance to give those data set tables as an example?

Is it logged clients or new user registration data? I mean you can see the 1 person information more than 1 time in 1 data set in the same period?

Thanks

Gokhan

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...