All,
Say I query Splunk and get a list of 1000 users today. And tomomorrow I do the same thing and get 1002 users. How can I get the 2 new users appeared over night? Basically diff the results of two searches?
Try like this
your base search ran with time-range for last two days (yesterday and day before yesterday) earliest=-2d@d latest=@d| eval day=strftime(_time,"%m/%d/%Y") | stats values(day) as days by user | where mvcount(days)=1 AND days=strftime(relative_time(now(),"-1d@d"),"%m/%d/%Y")