Skip to content

Instantly share code, notes, and snippets.

@hortonew

hortonew/Splunk-one-way-diff.txt

Created March 21, 2017 14:22
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save hortonew/ec59ffcbb113b516cfb6a28957936b22 to your computer and use it in GitHub Desktop.
Save hortonew/ec59ffcbb113b516cfb6a28957936b22 to your computer and use it in GitHub Desktop.
Download ZIP
Splunk one-way diff search
Raw
Splunk-one-way-diff.txt
| set diff
[| makeresults count=1 | eval users="user1 user2 user6" | makemv users | mvexpand users | table users | append [search sourcetype=linux_secure logged_in_user!="" | table users] | stats values(users) as users | mvexpand users | table users]
[search sourcetype=linux_secure logged_in_user!="" | stats values(logged_in_user) as users | mvexpand users | table users]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment