Hi, I have a query as follows
index="summary" search_name="ABC" | dedup hostname | table hostname
Now I want see the hostnames which are in last week's result and not in this week's result and vice versa?
What are the earliest and latest times that I should be specified in subsearch and main search? What could be the query to get that result?
Try like this (no subsearch). You can update the value of field remark per your need and then apply appropriate filter on the field remark to just keep the hostnames you're interested in.
index="summary" search_name="ABC" earliest=-1w@w latest=now
| bucket span=1w _time
| stats values(_time) as weeks by hostname
| eval remark=case(mvcount(weeks)=2,"Present in both weeks", weeks=relative_time(now(),"@w"),"Present this week but not last week", true(),"Present last week but not this week"
Take a look at the timewrap
command:
http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Timewrap
If you are on an older version of Splunk, you may need to install this app:
Try like this (no subsearch). You can update the value of field remark per your need and then apply appropriate filter on the field remark to just keep the hostnames you're interested in.
index="summary" search_name="ABC" earliest=-1w@w latest=now
| bucket span=1w _time
| stats values(_time) as weeks by hostname
| eval remark=case(mvcount(weeks)=2,"Present in both weeks", weeks=relative_time(now(),"@w"),"Present this week but not last week", true(),"Present last week but not this week"
@somesoni2 . what could be my query if I wanted to do a comparison between before last week and last week's results instead of last week and now. What needed to be changed on remark, earliest and latest.
Comment here or answer below
https://answers.splunk.com/answers/696339/how-to-change-earliest-and-latest-times-on-my-quer.html