Getting Data In

Reporting on Duplicates

mphillips_18
Engager

Hello,

So every 24 hours we run daily evaluations on computers that create numerical ratings. Our daily reports display Time(of scan), ComputerID, rating value. After 24 hours, all nodes are scanned again. Some will (hopefully) have a lower numerical rating value. We would like to run a separate report showing the change in value of the numerical rating for each compuert that actually changed over the 24 hour period.

ComputerID=5 character alpha numeric
Rating value=0-100

The following query works for single instances of evaluation.
index=main sourcetype=scan host=scanner ComputerID==1234R | stats range(numerical_rating) AS "Daily Change",values AS Computers | table Computers,"Daily Changes"

Unfortunately we can not get this to evaluate properly against 200 computerIDs at one time. Is there a way to separate out the duplicate computerIDs with associated unique numerical_ratings and then get the difference of the numerical_rating reported with the associated computerID?
DOH!

Thanks!

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Based on above generated data, you can do this:

index=main sourcetype=scan host=scanner | sort + _time
| streamstats window=1 global=f current=f last(Rating) as last_rating by ComputerID
| eval "Rating Change" = Rating - last_rating | table _time ComputerID Rating "Rating Change"

mphillips_18
Engager

BINGO! I missed one of the fields.

Thank you

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Make sure your field names match. For example, you've said ComputerID in the question but computerID in this comment.

0 Karma

mphillips_18
Engager

Thanks...the query returns data except for the "Rating Change" value. None of the duplicate computerIDs display a value for Rating - last_rating

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Does this generate a data set matching your events?

| gentimes start=-10 | eval _time = endtime | fields _time | eval ComputerID = "id1 id2 id3" | makemv ComputerID | mvexpand ComputerID | eval Rating = random()%101
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...