Splunk Search

compare last 5 days data

kig121
Loves-to-Learn Lots

I would like to listed those events (reuirements) which state are changed to Agreed from last 3 days.

Today have a database with 4 requirements which state is Agreed.

Example:

/   ID_3 is changed to Agreed /

_time    ID   Req_status

05/14   1     Agreed
05/14   2    Agreed
05/14   3     Agreed
05/14   4     Agreed

/  05/13 only 3 requirements which state Agreed ID_2 is changed to Agreed at 05/12 /

_time    ID   Req_status

05/13   1     Agreed
05/13   2    Agreed
05/13   4    Agreed

/  05/12 only 2 requirements which state Agreed  ID_1 is changed to Agreed at 05/12/

_time    ID   Req_status

05/12   1     Agreed
05/12   4    Agreed

/  05/11 only 1 requirements which state Agreed /

_time    ID   Req_status

05/11   4    Agreed

Expectations:  The last 3 days has arrived 3 new requirements. I would like to listed those requirements which arrives newly.

05/13   1     Agreed
05/13   2    Agreed
05/13   3    Agreed

Thanks for help!

Labels (1)
0 Karma

kig121
Loves-to-Learn Lots

I did not found previos question. Thanks for linkage.

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can find your previous posts by clicking on your avatar and selecting My subscriptions or My profile

ITWhisperer_0-1621263359613.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How is this different to your previous question https://community.splunk.com/t5/Splunk-Search/Compare-changes-today-to-last-7-days/m-p/551491#M15650... and how does the answer not work in this case?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...