Splunk Search

Will you help me compare 2 results from different time periods?

alanhowlett
New Member

I'm trying to compare 2 results from different time periods using the below search, but am getting a zero result where I should be seeing 2 events.

I've recreated the search as below into something that we can all see. I am using one existing field (sourcetype) and eval to create another (output) to do the math and output to a result field.

index=_internal earliest=-4d@d latest=-3d@d splunkd_stderr [ search index=_internal earliest=-3d@d latest=-2d@d splunkd_stderr 
| eval output=sourcetype] 
|  eval result=sourcetype-output 
|  stats count(result)  
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi alanhowlett,
I see two things that I don't understand:

Firstly, you cannot have the fully same event in two different dates. You have to choose which fields to use to compare search results. In other words, in the subsearch, you have to put the field names to compare, e.g.:

index=_internal earliest=-4d@d latest=-3d@d splunkd_stderr [ search index=_internal earliest=-3d@d latest=-2d@d splunkd_stderr | fields sourcetype] 
| stats count 

in this way, you count the events of the main search that have a source type that is present also in subsearch.

The second thing to clarify is: you say result=sourcetype-output . But these aren't numeric fields so you cannot detract.

So what's your need?

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...