I am using | set diff to find the names that have been changed yesterday compared to a week using the search as below
What i am trying to get is to show the ones that have been added and dropped in search it currently gives all together as one list.
| set diff [ search index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value >= 0.000 earliest=-1d@d latest=@m | stats count by name | table name ]
[ search index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value >= 0.000 earliest=-7d@d latest=-1d@d | stats count by name | table name ]
Unfortunately, there is no such option in | set
command, but you can achieve the same using an append-stats combination, like this
index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value >= 0.000 earliest=-1d@d latest=@m | stats count by name | table name | eval Action="Today" | append [ search index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value >= 0.000 earliest=-7d@d latest=-1d@d | stats count by name | table name | Action="Last7Days" ] | stats values(*) by name | where mvcount(Action)=1 | replace "Today" with "Added" "Last7Days" with "Deleted" in Action
Unfortunately, there is no such option in | set
command, but you can achieve the same using an append-stats combination, like this
index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value >= 0.000 earliest=-1d@d latest=@m | stats count by name | table name | eval Action="Today" | append [ search index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value >= 0.000 earliest=-7d@d latest=-1d@d | stats count by name | table name | Action="Last7Days" ] | stats values(*) by name | where mvcount(Action)=1 | replace "Today" with "Added" "Last7Days" with "Deleted" in Action