Splunk Search

How can I see the difference in a count for two different types of events by day?

Esperteyu
Explorer

Hi,

I would like to see the difference in a count for two different type of events per day. Currently I have it in total but not sure how to split it per day

index="index1" ("first string" OR "second string") | eval First=if(searchmatch("first string"),1,0) | eval Second=if(searchmatch("second string"),1,0) | stats sum(First) as FirstChecks sum(Second) as SecopndChecks | eval missing=FirstChecks - SecondChecks

Thanks

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

try this

index="index1" ("first string" OR "second string") 
| bin _time span=1d
| eval First=if(searchmatch("first string"),1,0) 
| eval Second=if(searchmatch("second string"),1,0) 
| stats sum(First) as FirstChecks sum(Second) as SecondChecks by _time 
| eval missing= FirstChecks - SecondChecks

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

try this

index="index1" ("first string" OR "second string") 
| bin _time span=1d
| eval First=if(searchmatch("first string"),1,0) 
| eval Second=if(searchmatch("second string"),1,0) 
| stats sum(First) as FirstChecks sum(Second) as SecondChecks by _time 
| eval missing= FirstChecks - SecondChecks
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...