Splunk Search

compare last 5 days data

kig121
Loves-to-Learn Lots

I would like to listed those events (reuirements) which state are changed to Agreed from last 3 days.

Today have a database with 4 requirements which state is Agreed.

Example:

/   ID_3 is changed to Agreed /

_time    ID   Req_status

05/14   1     Agreed
05/14   2    Agreed
05/14   3     Agreed
05/14   4     Agreed

/  05/13 only 3 requirements which state Agreed ID_2 is changed to Agreed at 05/12 /

_time    ID   Req_status

05/13   1     Agreed
05/13   2    Agreed
05/13   4    Agreed

/  05/12 only 2 requirements which state Agreed  ID_1 is changed to Agreed at 05/12/

_time    ID   Req_status

05/12   1     Agreed
05/12   4    Agreed

/  05/11 only 1 requirements which state Agreed /

_time    ID   Req_status

05/11   4    Agreed

Expectations:  The last 3 days has arrived 3 new requirements. I would like to listed those requirements which arrives newly.

05/13   1     Agreed
05/13   2    Agreed
05/13   3    Agreed

Thanks for help!

Labels (1)
0 Karma

kig121
Loves-to-Learn Lots

I did not found previos question. Thanks for linkage.

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can find your previous posts by clicking on your avatar and selecting My subscriptions or My profile

ITWhisperer_0-1621263359613.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How is this different to your previous question https://community.splunk.com/t5/Splunk-Search/Compare-changes-today-to-last-7-days/m-p/551491#M15650... and how does the answer not work in this case?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...