I am looking for a splunk solution for the below representation. This is basically, comparing the data on a field on two dates and find out which are not common on both dates.
So the output should be two values,
1. Added items count, compared to previous date.
2. Removed items count, compared to previous date.
Any suggestions for how to achieve this?
below is the one I tried, but gives only total difference, but i need 'Added' and 'Removed' items count separately.
| set diff [search sourcetype=data earliest=-3d@d latest=-2d@d |fields hostname, date_time| stats count by dest_ip |table dest_ip] [search sourcetype=data earliest=-1d@d latest=now |fields hostname, date_time| stats count by hostname|hostname]
Note: delta command doesn’t work in the below case.
alt text
... View more