Dear Experts,
I am looking to find the difference in the devices sending logs in the last 24 hour with devices which sent logs 30 days back.
Search:
| tstats values(host) AS Host dc(host) as count by sourcetype,index | eval sourcetype=sourcetype." - ".count | stats list(sourcetype) as "sourcetype-hostCount" by index, Host
Lets say for the ast 24 hours, it list 40 devices, and for last 30 days it list 60 devices.
I need an output of the difference which should list the 20 devices which are not sending logs from the past 1 day.
Try this
| tstats count latest(_time) as latest by host sourcetype index
| eval last24hours=if(latest>=relative_time(now(),"-24h"),"Yes","No")
| eval last30days=if(latest>=relative_time(now(),"-30d"),"Yes","No")
| where last30days="Yes" and last24hours="No"
| stats list(sourcetype) as sourcetypes list(count) as counts sum(count) as Total by index host