Hello,
I would like to find the difference between values in a couple of fields for two months.
I figured out how to do that just for one field:
|set diff [search index = test_im REPORT_PERIOD="2015-10-01 00:00:00"| stats count by Client Type Type2| fields - count] [search index = test_im REPORT_PERIOD="2015-09-01 00:00:00"| stats count by Client Type Type2 | fields - count]
However, for a couple fields, it's not working properly. It would be nice if the result looked like this (unique difference values):
Client Type Type2
<difference unique values> <difference unique values> <difference unique values>
Thank you
Hi,
Here is the option that you can use. I assume you have a variables called REPORT_PERIOD. Then you can use join or depends on visualization and your needs you can also use appendcols command.
search index = test_im REPORT_PERIOD="2015-10-01 00:00:00"| stats count by Client Type Type2|fields - count
|join REPORT_PERIOD [search index = test_im REPORT_PERIOD="2015-09-01 00:00:00"|stats count by Client Type Type2|fields - count]
|table Client,Type,Type2
You can find more details from the link below.
http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Join
http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Appendcols
Hope it is clear.
Thanks
Gokhan
Hi
Unfortunately this is not working. I want to see the different unique values which are exist in one data set and not exist in second one.
e.g. If a new client appear in new month this need to be shown
or if a client which exists in previous month but in current month is not visible
Thank you with helping here
Hi ,
Is there any chance to give those data set tables as an example?
Is it logged clients or new user registration data? I mean you can see the 1 person information more than 1 time in 1 data set in the same period?
Thanks
Gokhan