In that case, host field is "eventID"
First of all, be careful with the word "event" when talking about Splunk search because if you use tstats, you cannot retrieve what Splunk defines as an "event". So, I assume that your events carries an identifying field, say "eventID", and that you want to find which eventID's exist in the 90-day search but not in the 30-day search. Is this correct?
For this, you can do something like
| tstats count where earliest=-30d by eventID
| eval thisis = "30day"
| append
[| tstats count where earliest=-90d by eventID
| eval thisis = "90day"]
| stats values(thisis) as thisis by eventID
| where mvcount(thisis) == 1 AND thisis == "90day"
Hope this helps.
Hi,
thanks for the reply! I am doing it for hosts to see which are missing.
In that case, host field is "eventID"