Splunk Search

Searching issues in comparing data

Explorer

Hi Splunker beginner here.

I'm having an issue in forming the search syntax for comparing the biggest amount of client logs deleted accidentally on a current day as opposed to the average of the previous month. I'm here at the moment source="deleted.xml" earliest=-d ACCIDENTAL_DELETES > ...

0 Karma
1 Solution

Revered Legend

The pseudo search would be like this

source="deleted.xml" earliest=@d ACCIDENTAL_DELETES > ...
| stats count by client_indentifier_field
| where count>[search source="deleted.xml" earliest=-1mon@m latest=@mon ACCIDENTAL_DELETES > ..   | query to calculate last month's average | table average | rename average  as query]

View solution in original post

Revered Legend

The pseudo search would be like this

source="deleted.xml" earliest=@d ACCIDENTAL_DELETES > ...
| stats count by client_indentifier_field
| where count>[search source="deleted.xml" earliest=-1mon@m latest=@mon ACCIDENTAL_DELETES > ..   | query to calculate last month's average | table average | rename average  as query]

View solution in original post

Explorer

With some additional play around with the syntax I managed to solve it. Thanks.

0 Karma

Explorer

To be more specific I'm searching for all the amounts of accidental deletes on the current day that supersedes the avg for the previous month.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!