Splunk Search

how to show added and deleted in set diff

vinay4444
Explorer

I am using | set diff to find the names that have been changed yesterday compared to a week using the search as below

What i am trying to get is to show the ones that have been added and dropped in search it currently gives all together as one list.

| set diff [ search index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value >= 0.000 earliest=-1d@d latest=@m | stats count by name | table name ]

[ search index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value >= 0.000 earliest=-7d@d latest=-1d@d | stats count by name | table name ]

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Unfortunately, there is no such option in | set command, but you can achieve the same using an append-stats combination, like this

index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value >= 0.000 earliest=-1d@d latest=@m | stats count by name | table name | eval Action="Today" | append [ search index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value >= 0.000 earliest=-7d@d latest=-1d@d | stats count by name | table name | Action="Last7Days" ] | stats values(*) by name | where mvcount(Action)=1 | replace "Today" with "Added" "Last7Days" with "Deleted" in Action

View solution in original post

0 Karma

somesoni2
Revered Legend

Unfortunately, there is no such option in | set command, but you can achieve the same using an append-stats combination, like this

index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value >= 0.000 earliest=-1d@d latest=@m | stats count by name | table name | eval Action="Today" | append [ search index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value >= 0.000 earliest=-7d@d latest=-1d@d | stats count by name | table name | Action="Last7Days" ] | stats values(*) by name | where mvcount(Action)=1 | replace "Today" with "Added" "Last7Days" with "Deleted" in Action
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...