Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- how to show added and deleted in set diff
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am using | set diff to find the names that have been changed yesterday compared to a week using the search as below
What i am trying to get is to show the ones that have been added and dropped in search it currently gives all together as one list.
| set diff [ search index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value >= 0.000 earliest=-1d@d latest=@m | stats count by name | table name ]
[ search index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value >= 0.000 earliest=-7d@d latest=-1d@d | stats count by name | table name ]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Unfortunately, there is no such option in | set command, but you can achieve the same using an append-stats combination, like this
index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value >= 0.000 earliest=-1d@d latest=@m | stats count by name | table name | eval Action="Today" | append [ search index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value >= 0.000 earliest=-7d@d latest=-1d@d | stats count by name | table name | Action="Last7Days" ] | stats values(*) by name | where mvcount(Action)=1 | replace "Today" with "Added" "Last7Days" with "Deleted" in Action
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Unfortunately, there is no such option in | set command, but you can achieve the same using an append-stats combination, like this
index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value >= 0.000 earliest=-1d@d latest=@m | stats count by name | table name | eval Action="Today" | append [ search index=infra_service_perf sourcetype="XXX" itemKey ="XXXX" value >= 0.000 earliest=-7d@d latest=-1d@d | stats count by name | table name | Action="Last7Days" ] | stats values(*) by name | where mvcount(Action)=1 | replace "Today" with "Added" "Last7Days" with "Deleted" in Action
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
