Will you help me compare 2 results from different time periods?

[alanhowlett]

I'm trying to compare 2 results from different time periods using the below search, but am getting a zero result where I should be seeing 2 events.

I've recreated the search as below into something that we can all see. I am using one existing field (sourcetype) and eval to create another (output) to do the math and output to a result field.

index=_internal earliest=-4d@d latest=-3d@d splunkd_stderr [ search index=_internal earliest=-3d@d latest=-2d@d splunkd_stderr 
| eval output=sourcetype] 
|  eval result=sourcetype-output 
|  stats count(result)  

[gcusello]

Hi alanhowlett,
I see two things that I don't understand:

Firstly, you cannot have the fully same event in two different dates. You have to choose which fields to use to compare search results. In other words, in the subsearch, you have to put the field names to compare, e.g.:

index=_internal earliest=-4d@d latest=-3d@d splunkd_stderr [ search index=_internal earliest=-3d@d latest=-2d@d splunkd_stderr | fields sourcetype] 
| stats count 

in this way, you count the events of the main search that have a source type that is present also in subsearch.

The second thing to clarify is: you say result=sourcetype-output . But these aren't numeric fields so you cannot detract.

So what's your need?

Bye.
Giuseppe