Splunk Search

search with same field diferent dates into a table side by side

rsaude
Path Finder

i want to verify if there is a difference in 2 counts made that relate to diferent timelines.

This is what i've came up with

index="tenablesc" sourcetype="tenable:sc:assets" 
| dedup ip 
| stats count(ip) as "Number of machines Detected(All time)" 
| append 
    [ search index="teenablesc" sourcetype="tenable:sc:assets" earliest=-14d 
    | dedup ip 
    | stats count(ip) as "Number of machines Detected(Past 14 days)" ]

and the output is the following:alt text

I would like to put both on the same line, or even if possible just have one field that is the difference between both values

Thank you for any help you can provide

Tags (2)
0 Karma
1 Solution

rsaude
Path Finder

I kinda dumb just use a join instead of an append.
I wont delete the question because it might be usefull to others

View solution in original post

0 Karma

wmyersas
Builder

instead of doing a | dedup ip | stats count(ip)...you can just do | stats dc(ip) as ...

It's faster, and simpler

0 Karma

rsaude
Path Finder

I kinda dumb just use a join instead of an append.
I wont delete the question because it might be usefull to others

0 Karma

gcusello
SplunkTrust
SplunkTrust

explore the use of wimewrap!

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...