Splunk Search

compare last 5 days data

kig121
Loves-to-Learn Lots

I would like to listed those events (reuirements) which state are changed to Agreed from last 3 days.

Today have a database with 4 requirements which state is Agreed.

Example:

/   ID_3 is changed to Agreed /

_time    ID   Req_status

05/14   1     Agreed
05/14   2    Agreed
05/14   3     Agreed
05/14   4     Agreed

/  05/13 only 3 requirements which state Agreed ID_2 is changed to Agreed at 05/12 /

_time    ID   Req_status

05/13   1     Agreed
05/13   2    Agreed
05/13   4    Agreed

/  05/12 only 2 requirements which state Agreed  ID_1 is changed to Agreed at 05/12/

_time    ID   Req_status

05/12   1     Agreed
05/12   4    Agreed

/  05/11 only 1 requirements which state Agreed /

_time    ID   Req_status

05/11   4    Agreed

Expectations:  The last 3 days has arrived 3 new requirements. I would like to listed those requirements which arrives newly.

05/13   1     Agreed
05/13   2    Agreed
05/13   3    Agreed

Thanks for help!

Labels (1)
0 Karma

kig121
Loves-to-Learn Lots

I did not found previos question. Thanks for linkage.

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can find your previous posts by clicking on your avatar and selecting My subscriptions or My profile

ITWhisperer_0-1621263359613.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How is this different to your previous question https://community.splunk.com/t5/Splunk-Search/Compare-changes-today-to-last-7-days/m-p/551491#M15650... and how does the answer not work in this case?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...