Splunk Search

Will you help me compare 2 results from different time periods?

alanhowlett
New Member

I'm trying to compare 2 results from different time periods using the below search, but am getting a zero result where I should be seeing 2 events.

I've recreated the search as below into something that we can all see. I am using one existing field (sourcetype) and eval to create another (output) to do the math and output to a result field.

index=_internal earliest=-4d@d latest=-3d@d splunkd_stderr [ search index=_internal earliest=-3d@d latest=-2d@d splunkd_stderr 
| eval output=sourcetype] 
|  eval result=sourcetype-output 
|  stats count(result)  
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi alanhowlett,
I see two things that I don't understand:

Firstly, you cannot have the fully same event in two different dates. You have to choose which fields to use to compare search results. In other words, in the subsearch, you have to put the field names to compare, e.g.:

index=_internal earliest=-4d@d latest=-3d@d splunkd_stderr [ search index=_internal earliest=-3d@d latest=-2d@d splunkd_stderr | fields sourcetype] 
| stats count 

in this way, you count the events of the main search that have a source type that is present also in subsearch.

The second thing to clarify is: you say result=sourcetype-output . But these aren't numeric fields so you cannot detract.

So what's your need?

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...