Problem with the diff command

[ysdeos]

Hi!

Every time a user enters my system, I report his userId.
I tried using the DIFF operation to find out which userIds entered my system in the past 7 days but didn't enter in the past 3 days.

I used the following query:

| set diff [search userId earliest=-7d | fields userId] [search userId earliest=-3d | fields userId] | stats count by userId

This didn't work. It seems like Splunk ignored my request to search for the last 7 days of reports and actually queried this:

| set diff [search userId earliest=-1d | fields userId] [search userId earliest=-1d | fields userId] | stats count by userId

I came to this conclusion by doing the following:

| set diff [search userId earliest=-1d | fields userId] [search userId earliest=-0d | fields userId] | stats count by userId

(returned 0 results)

and compared it with:

| set diff [search userId earliest=-7d | fields userId] [search userId earliest=-0d | fields userId] | stats count by userId

(returned 1000 results)
and

userId earliest=-7d | stats count by userId

(returned 1000 results)

Thank you!

[Drainy]

Using set diff will return the results that are not common to both subsearches. You are searching over all 7 days in your first subsearch and then the last three days, this will create an overlap (so the results will be the same).

What happens if you also set the latest too?
Something like;

| set diff [search userId earliest=-7d@d latest=-4d@d | fields userId] [search userId earliest=-3d@d | fields userId] | stats count by userId

I'm not able to test this so sorry if its not quite right, just going off the docs. Also my times may be slightly out of sync, too early in the morning for thinking 🙂