Splunk Search

How can I compare a list of users to another set?

daniel333
Builder

All,

Say I query Splunk and get a list of 1000 users today. And tomomorrow I do the same thing and get 1002 users. How can I get the 2 new users appeared over night? Basically diff the results of two searches?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

your base search ran with time-range for last two days (yesterday and day before yesterday) earliest=-2d@d latest=@d| eval day=strftime(_time,"%m/%d/%Y") | stats values(day) as days by user | where mvcount(days)=1  AND days=strftime(relative_time(now(),"-1d@d"),"%m/%d/%Y") 
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...