Hi alanhowlett,
I see two things that I don't understand:
Firstly, you cannot have the fully same event in two different dates. You have to choose which fields to use to compare search results. In other words, in the subsearch, you have to put the field names to compare, e.g.:
index=_internal earliest=-4d@d latest=-3d@d splunkd_stderr [ search index=_internal earliest=-3d@d latest=-2d@d splunkd_stderr | fields sourcetype]
| stats count
in this way, you count the events of the main search that have a source type that is present also in subsearch.
The second thing to clarify is: you say result=sourcetype-output . But these aren't numeric fields so you cannot detract.
So what's your need?
Bye.
Giuseppe
... View more