×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
winter0827
Engager
Member since: ‎06-06-2022
‎06-14-2022
Community Statistics
Posts 3
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎06-06-2022
View All

Re: Only show new data compared to yesterday

by in Splunk Search
‎06-14-2022 01:10 AM
‎06-14-2022 01:10 AM
firstly, I would like to compare day to day data. And list the count by key. and then I want to expand the timeframe and compare the week by week, month by month data.  for both cases above, I want to know which values are NEW in last day/week/month. ... View more

Re: Only show new data compared to yesterday

by in Splunk Search
‎06-13-2022 03:47 PM
‎06-13-2022 03:47 PM
Thanks, that solves my problem. A follow up: how can I compare the values in last 2 weeks and only show the new ones in this week? ... View more

How to build query that Only shows new data compar...

by in Splunk Search
‎06-06-2022 09:47 PM
‎06-06-2022 09:47 PM
Hi all, I am trying to build a query that only shows the NEW results compared to yesterday. I would like to get some alert and data to show ONLY if the message/key is new today, compared to the results yesterday. for example:    {query} | stats count by key   Yesterday, the query returned - "key1", and "key2". | key    | count | | key1 | 10       | | key2 | 5        | Today, there are some results returned - "key1", and "key3". I would like to get the count of "key3" only as it is new today and didn't show up yesterday. | key    | count | | key3 | 15       | Thanks in advance! ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎06-14-2022 05:02 AM