Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Splunk Search
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Searching issues in comparing data
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
user290317
Explorer
04-05-2017
02:12 PM
Hi Splunker beginner here.
I'm having an issue in forming the search syntax for comparing the biggest amount of client logs deleted accidentally on a current day as opposed to the average of the previous month. I'm here at the moment source="deleted.xml" earliest=-d ACCIDENTAL_DELETES > ...
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
somesoni2
Revered Legend
04-05-2017
02:49 PM
The pseudo search would be like this
source="deleted.xml" earliest=@d ACCIDENTAL_DELETES > ...
| stats count by client_indentifier_field
| where count>[search source="deleted.xml" earliest=-1mon@m latest=@mon ACCIDENTAL_DELETES > .. | query to calculate last month's average | table average | rename average as query]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
somesoni2
Revered Legend
04-05-2017
02:49 PM
The pseudo search would be like this
source="deleted.xml" earliest=@d ACCIDENTAL_DELETES > ...
| stats count by client_indentifier_field
| where count>[search source="deleted.xml" earliest=-1mon@m latest=@mon ACCIDENTAL_DELETES > .. | query to calculate last month's average | table average | rename average as query]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
user290317
Explorer
04-06-2017
02:58 AM
With some additional play around with the syntax I managed to solve it. Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
user290317
Explorer
04-05-2017
02:24 PM
To be more specific I'm searching for all the amounts of accidental deletes on the current day that supersedes the avg for the previous month.
Got questions? Get answers!
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Meet up IRL or virtually!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Get Updates on the Splunk Community!
Persistent Queue at TcpOut — One of Splunk's Most Practical Features
Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...
Catalog Is Now Generally Available on Splunk Cloud Platform
A Unified View of Your Data
Security logs, application events, business data, and historical telemetry often ...
Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner
Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner
Watch on demand us for a demo-driven ...
