Splunk Search

search with same field diferent dates into a table side by side

rsaude
Path Finder

i want to verify if there is a difference in 2 counts made that relate to diferent timelines.

This is what i've came up with

index="tenablesc" sourcetype="tenable:sc:assets" 
| dedup ip 
| stats count(ip) as "Number of machines Detected(All time)" 
| append 
    [ search index="teenablesc" sourcetype="tenable:sc:assets" earliest=-14d 
    | dedup ip 
    | stats count(ip) as "Number of machines Detected(Past 14 days)" ]

and the output is the following:alt text

I would like to put both on the same line, or even if possible just have one field that is the difference between both values

Thank you for any help you can provide

Tags (2)
0 Karma
1 Solution

rsaude
Path Finder

I kinda dumb just use a join instead of an append.
I wont delete the question because it might be usefull to others

View solution in original post

0 Karma

wmyersas
Builder

instead of doing a | dedup ip | stats count(ip)...you can just do | stats dc(ip) as ...

It's faster, and simpler

0 Karma

rsaude
Path Finder

I kinda dumb just use a join instead of an append.
I wont delete the question because it might be usefull to others

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

explore the use of wimewrap!

Ciao.
Giuseppe

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!