I'm using a modified search from splunksearches.com to get the events from the past two days and returning the difference. For all of the indexes and sourcetypes, if it exists, in the testlookup. While it works the index and sourcetype does not line up with the results. Mapping I found handles this SPL a little different than a normal search, location of the stats command had to be moved to return the same results. My question is there a way to modify the SPL so the index/sourcetype lines up with the results? I'm pretty sure I'll eventually get it but already spent enough time on this. thanks testlookup: has the columns index and sourcetype | inputlookup testlookup
|eval index1=index
|eval sourcetype1=if (isnull(sourcetype),"","sourcetype="+sourcetype)
|appendpipe
[|map search="search index=$index1$ earliest=-48h latest=-24h | bin _time span=1d | eval window=\"Yesterday\"| stats count by _time window | append [|search index=$index1$ earliest=-24h | eval window=\"Today\"| bin _time span=1d | stats count by _time window | eval _time=(_time-(60*60*24))] | timechart span=1d sum(count) by window|eval difference = abs(Yesterday - Today)"]| table index1 sourcetype1 Yesterday Today difference index1 sourcetype1 yesterday today difference test1 st_test1 10 20 10
... View more