Problem with set command

[megancarney]

I'm trying to get use the set command to monitor differences between two sets of DNS records.

I've looked through the documentation and previous questions on the topic and still can't make it work.

This search has 10 results:

index=dns_processed earliest=-8d | top Hostname | fields Hostname

This search has 49 results:

index=dns_processed earliest=-8d | fields Hostname

But for some reason, this search has 0 results:

set union [search index=dns_processed earliest=-8d | top Hostname | fields Hostname] [search index=dns_processed earliest=-8d | fields Hostname]

Any hints?

[megancarney]

Okay, the problem was stupid-simple. The set command needs a pipe before it or splunk doesn't interpret 'set' as a command.

So:
| set union [search index=dns_processed earliest=-8d | top Hostname | fields Hostname] [search index=dns_processed earliest=-8d | fields Hostname]

[Ayn]

It's been a while since I've used set now, but from what I recall I had similar problems which in the end were due to that internal fields such as _time were implicitly returned from the subsearches. So the sets being compared didn't just consist of the field I wanted to check (which in your case would be Hostname), but also of timestamps and various other stuff. I solved it by adding | fields -_* at the end of my subsearches. Let me know if this is the problem you're running into as well.

[megancarney]

Didn't help. 😞