Splunk Search

compare last 5 days data

kig121
Loves-to-Learn Lots

I would like to listed those events (reuirements) which state are changed to Agreed from last 3 days.

Today have a database with 4 requirements which state is Agreed.

Example:

/   ID_3 is changed to Agreed /

_time    ID   Req_status

05/14   1     Agreed
05/14   2    Agreed
05/14   3     Agreed
05/14   4     Agreed

/  05/13 only 3 requirements which state Agreed ID_2 is changed to Agreed at 05/12 /

_time    ID   Req_status

05/13   1     Agreed
05/13   2    Agreed
05/13   4    Agreed

/  05/12 only 2 requirements which state Agreed  ID_1 is changed to Agreed at 05/12/

_time    ID   Req_status

05/12   1     Agreed
05/12   4    Agreed

/  05/11 only 1 requirements which state Agreed /

_time    ID   Req_status

05/11   4    Agreed

Expectations:  The last 3 days has arrived 3 new requirements. I would like to listed those requirements which arrives newly.

05/13   1     Agreed
05/13   2    Agreed
05/13   3    Agreed

Thanks for help!

Labels (1)
0 Karma

kig121
Loves-to-Learn Lots

I did not found previos question. Thanks for linkage.

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can find your previous posts by clicking on your avatar and selecting My subscriptions or My profile

ITWhisperer_0-1621263359613.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How is this different to your previous question https://community.splunk.com/t5/Splunk-Search/Compare-changes-today-to-last-7-days/m-p/551491#M15650... and how does the answer not work in this case?

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...