Splunk Search

comparing files

JovanMilosevic
Path Finder

We have a flat file that contains user data. Changes made to this file are not audited. I'd like Splunk to report on users added or deleted. This is sort of straight forward, in that we can index the file each month. Then search earliest say 32 days,

search ... | transaction user | where duration=0

Will give me records that are singletons, and have either been created or deleted. If the date is last month's, then it has been deleted, and if it's this month, it's beeen added. I can tell this by looking at the dates, but what I'd like to do is evaluate a field that says "Added" or "Deleted".

The date of each transaction will allways be of the form "YYY/MM/01 01:00:00", as the file itself doesn't contain a date, so it is added via a script.

Any ideas ?

1 Solution

Ayn
Legend

Use eval to create a field that will say "Deleted" if the event is from last month (or older), and "Added" if it's newer than that.

<yourbasesearch> | eval useraction=if(_time < relative_time(now(),"-1m@m"),"Deleted","Added")

View solution in original post

Ayn
Legend

Use eval to create a field that will say "Deleted" if the event is from last month (or older), and "Added" if it's newer than that.

<yourbasesearch> | eval useraction=if(_time < relative_time(now(),"-1m@m"),"Deleted","Added")

JovanMilosevic
Path Finder

Thanks for the speedy response. The relative time should be "-1mon" and I dropped the snap to.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...