Splunk Search

compare results of two searches to detect new activity

dbylertbg
Path Finder

How do I compare two searches to find values that exist in one search but not the other? For example, how do I report on users who have logged in today who haven't logged in for the previous 6 months?

If I have a search that lists every user to log in to a system, I can run that search over the previous 6 month period excluding today (earliest=-6m, latest=@d) to get my historical list, and run it again for just today (earliest=@d, latest=now) to get today's list, but I'm stuck figuring out how to compare the lists for values unique to today's list: I want to see if there are any users who logged in today that haven't logged in during the previous 6 months.

Tags (3)
0 Karma

jonuwz
Influencer

You don't need to join searches to do that.

Just search over the last 6 months, get the earliest login time on record, and if that time is within the last 24 hours, today is the 1st time they logged in in 6 months

earliest=-6mon ... | stats min(_time) as _time by user | where _time > now() - 86400

jonuwz
Influencer

how many rows has it scanned, and how frequently are you going to be doing this ?

0 Karma

dbylertbg
Path Finder

Thanks, that makes sense. Don't know why I always forget about the _time field... 🙂

My test search is still running (started it right after you posted, thanks for the quick response!) and it seems to be working: My results list started by increasing and increasing (as expected, as it searched through the past 24 hours and found everyone to log in within the past 24 hours) and is now decreasing and decreasing as (I presume) it finds earlier logons for various users.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...