Splunk Search

compare last 5 days data

kig121
Loves-to-Learn Lots

I would like to listed those events (reuirements) which state are changed to Agreed from last 3 days.

Today have a database with 4 requirements which state is Agreed.

Example:

/   ID_3 is changed to Agreed /

_time    ID   Req_status

05/14   1     Agreed
05/14   2    Agreed
05/14   3     Agreed
05/14   4     Agreed

/  05/13 only 3 requirements which state Agreed ID_2 is changed to Agreed at 05/12 /

_time    ID   Req_status

05/13   1     Agreed
05/13   2    Agreed
05/13   4    Agreed

/  05/12 only 2 requirements which state Agreed  ID_1 is changed to Agreed at 05/12/

_time    ID   Req_status

05/12   1     Agreed
05/12   4    Agreed

/  05/11 only 1 requirements which state Agreed /

_time    ID   Req_status

05/11   4    Agreed

Expectations:  The last 3 days has arrived 3 new requirements. I would like to listed those requirements which arrives newly.

05/13   1     Agreed
05/13   2    Agreed
05/13   3    Agreed

Thanks for help!

Labels (1)
0 Karma

kig121
Loves-to-Learn Lots

I did not found previos question. Thanks for linkage.

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can find your previous posts by clicking on your avatar and selecting My subscriptions or My profile

ITWhisperer_0-1621263359613.pngITWhisperer_0-1621263359613.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How is this different to your previous question https://community.splunk.com/t5/Splunk-Search/Compare-changes-today-to-last-7-days/m-p/551491#M15650... and how does the answer not work in this case?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agentic Operations Start with Context: Build the Right Data Foundation

Agentic Operations Start with Context: Build the Right Data Foundation   By Courtney Wright, Product Marketing ...

Assisted, Augmented or Agentic? Choose Your Splunk Starting Point

Assisted, Augmented or Agentic? Choose Your Splunk Starting Point   By Courtney Wright, Product Marketing ...

Session 2 | Beyond the Thread: Operationalizing AI with Confidence

Session 2   Beyond the Thread: Operationalizing AI with Confidence    The true power of the Cisco Data Fabric ...