Splunk Search

Problem with the diff command

ysdeos
New Member

Hi!

Every time a user enters my system, I report his userId.
I tried using the DIFF operation to find out which userIds entered my system in the past 7 days but didn't enter in the past 3 days.

I used the following query:

| set diff [search userId earliest=-7d | fields userId] [search userId earliest=-3d | fields userId] | stats count by userId

This didn't work. It seems like Splunk ignored my request to search for the last 7 days of reports and actually queried this:

| set diff [search userId earliest=-1d | fields userId] [search userId earliest=-1d | fields userId] | stats count by userId

I came to this conclusion by doing the following:

| set diff [search userId earliest=-1d | fields userId] [search userId earliest=-0d | fields userId] | stats count by userId

(returned 0 results)

and compared it with:

| set diff [search userId earliest=-7d | fields userId] [search userId earliest=-0d | fields userId] | stats count by userId

(returned 1000 results)
and

userId earliest=-7d | stats count by userId

(returned 1000 results)

Thank you!

Tags (2)
0 Karma

Drainy
Champion

Using set diff will return the results that are not common to both subsearches. You are searching over all 7 days in your first subsearch and then the last three days, this will create an overlap (so the results will be the same).

What happens if you also set the latest too?
Something like;

| set diff [search userId earliest=-7d@d latest=-4d@d | fields userId] [search userId earliest=-3d@d | fields userId] | stats count by userId

I'm not able to test this so sorry if its not quite right, just going off the docs. Also my times may be slightly out of sync, too early in the morning for thinking 🙂

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...